General

  • Target

    JaffaCakes118_7d2ae7d5206eb3c15ccda5d0059be953

  • Size

    4.5MB

  • Sample

    250107-2m37nsskcv

  • MD5

    7d2ae7d5206eb3c15ccda5d0059be953

  • SHA1

    aa8eafc0d8b790607f37d326559b205d26512bf9

  • SHA256

    010af069cd333ded9bdf4035a489299df74b87b727ba862897952d470310d348

  • SHA512

    509766b3df02e8ae9c76ddb7f69d76ccfecb4bc8cb43252202889217be9a6e254e658750d76545bdaf8e3533715140bbc721c1a7e6400add941d0b3b832cf30b

  • SSDEEP

    98304:TL6ZnmR/d9dPavLzls0SbsQKUN+YQPVfSqkOUs2gO8vGW2F3ty:gnmraDziH1FQfSqkOJduz6

Malware Config

Extracted

Family

redline

Botnet

rich

C2

185.238.169.158:7765

Attributes
  • auth_value

    60ec0c9678621becd603caa1ce0c1314

Targets

    • Target

      JaffaCakes118_7d2ae7d5206eb3c15ccda5d0059be953

    • Size

      4.5MB

    • MD5

      7d2ae7d5206eb3c15ccda5d0059be953

    • SHA1

      aa8eafc0d8b790607f37d326559b205d26512bf9

    • SHA256

      010af069cd333ded9bdf4035a489299df74b87b727ba862897952d470310d348

    • SHA512

      509766b3df02e8ae9c76ddb7f69d76ccfecb4bc8cb43252202889217be9a6e254e658750d76545bdaf8e3533715140bbc721c1a7e6400add941d0b3b832cf30b

    • SSDEEP

      98304:TL6ZnmR/d9dPavLzls0SbsQKUN+YQPVfSqkOUs2gO8vGW2F3ty:gnmraDziH1FQfSqkOJduz6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks