General

  • Target

    JaffaCakes118_4623470aab13984d78112763a7abfbcd

  • Size

    4.6MB

  • Sample

    250107-b12b5axpgx

  • MD5

    4623470aab13984d78112763a7abfbcd

  • SHA1

    1b2d0421f60ce3db055b223d1a73fd3d20a0514f

  • SHA256

    5936288f99873e6cb0c80eeaec0659810b5de510c8625483f2595d33909a4b4e

  • SHA512

    12c288735b5fac383ef3bb9b0348ad510e01867a19444c45c591c6e3ac1442be14a29096266fa412b4c362327ad7a80040fe96f9c7e2d9ad5db38b0ef94ff841

  • SSDEEP

    98304:QLxu2gPPzlTrwo6r3pBl2RqebGrx9EKwXQ0B4WmS442Fuh/W97D:rP7lwoC3v08ebGrx9EKwXNBdxMFuBW

Malware Config

Extracted

Family

redline

Botnet

@tron323

C2

185.209.22.181:29234

Attributes
  • auth_value

    5a0918bd3e8ede8e02c8dd9d106a996d

Targets

    • Target

      JaffaCakes118_4623470aab13984d78112763a7abfbcd

    • Size

      4.6MB

    • MD5

      4623470aab13984d78112763a7abfbcd

    • SHA1

      1b2d0421f60ce3db055b223d1a73fd3d20a0514f

    • SHA256

      5936288f99873e6cb0c80eeaec0659810b5de510c8625483f2595d33909a4b4e

    • SHA512

      12c288735b5fac383ef3bb9b0348ad510e01867a19444c45c591c6e3ac1442be14a29096266fa412b4c362327ad7a80040fe96f9c7e2d9ad5db38b0ef94ff841

    • SSDEEP

      98304:QLxu2gPPzlTrwo6r3pBl2RqebGrx9EKwXQ0B4WmS442Fuh/W97D:rP7lwoC3v08ebGrx9EKwXNBdxMFuBW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks