General

  • Target

    JaffaCakes118_466700150bb2f8586deeaf444f517378

  • Size

    518KB

  • Sample

    250107-b5nltszphk

  • MD5

    466700150bb2f8586deeaf444f517378

  • SHA1

    d31371b53407d36b0df8f86b31bfaab9838b1e85

  • SHA256

    60330e76181c389adefa77da00253615becd62f85d33215d3870fdf6039e6a89

  • SHA512

    34293781da10c90a3e69bfb95966082092bde48b653d719a85f724755737f8d60daeed6aa6dfff4e72ab8eb6a839636c778fd22cd4c56131d14d0aa568183f2f

  • SSDEEP

    3072:1NkNBM19n+L0rSGn684ipBCZg8TuX10qXLB6gdWAQ82/mke3iLelwaYS:1NkNBMJSG684Wz10gd486mcL2wah

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_466700150bb2f8586deeaf444f517378

    • Size

      518KB

    • MD5

      466700150bb2f8586deeaf444f517378

    • SHA1

      d31371b53407d36b0df8f86b31bfaab9838b1e85

    • SHA256

      60330e76181c389adefa77da00253615becd62f85d33215d3870fdf6039e6a89

    • SHA512

      34293781da10c90a3e69bfb95966082092bde48b653d719a85f724755737f8d60daeed6aa6dfff4e72ab8eb6a839636c778fd22cd4c56131d14d0aa568183f2f

    • SSDEEP

      3072:1NkNBM19n+L0rSGn684ipBCZg8TuX10qXLB6gdWAQ82/mke3iLelwaYS:1NkNBMJSG684Wz10gd486mcL2wah

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks