General

  • Target

    JaffaCakes118_7e1efc1ee0c693388bd72a6879d2382f

  • Size

    4.6MB

  • Sample

    250107-23z5ysvmgn

  • MD5

    7e1efc1ee0c693388bd72a6879d2382f

  • SHA1

    a783c0fb271982fbda22964bc5b4a482143a72f4

  • SHA256

    21dda24bdc25d4a6425d66a7722ae847c91a6d814b37183db5f3d7f71db4aace

  • SHA512

    c05a945e45168291ef898a89f16a8a96b4a786359688efc0245d1cd0f01097358e2d582386deb7b40551691b72069e7ea1f8d62c7c8e869fa98b5843b10b9d7b

  • SSDEEP

    98304:DLt4JpIB1DBkkO3YhfZ03QdiE2LdnbH0frhpzXO+cmS5:aIXS+UQ98boVcmS5

Malware Config

Extracted

Family

redline

Botnet

@bbakoch

C2

92.119.113.189:21746

Attributes
  • auth_value

    de713911efa818890ac36085c9a0fc58

Targets

    • Target

      JaffaCakes118_7e1efc1ee0c693388bd72a6879d2382f

    • Size

      4.6MB

    • MD5

      7e1efc1ee0c693388bd72a6879d2382f

    • SHA1

      a783c0fb271982fbda22964bc5b4a482143a72f4

    • SHA256

      21dda24bdc25d4a6425d66a7722ae847c91a6d814b37183db5f3d7f71db4aace

    • SHA512

      c05a945e45168291ef898a89f16a8a96b4a786359688efc0245d1cd0f01097358e2d582386deb7b40551691b72069e7ea1f8d62c7c8e869fa98b5843b10b9d7b

    • SSDEEP

      98304:DLt4JpIB1DBkkO3YhfZ03QdiE2LdnbH0frhpzXO+cmS5:aIXS+UQ98boVcmS5

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks