General

  • Target

    JaffaCakes118_4897c06dfc387d7f37803bc743c899fd

  • Size

    168KB

  • Sample

    250107-c2qgpaskgp

  • MD5

    4897c06dfc387d7f37803bc743c899fd

  • SHA1

    ecb53d5b850b0112b30eddda79aa8ad0d24705ad

  • SHA256

    26e0ed9fb2128e8290310478202ab919cb803ef83cb3d749f96498d94f4d1607

  • SHA512

    e5c78c0ce52c6aa4e9d066a89fbc7cfa463cdcf3cbddb7ed240c4bce2613f9174c1df4583d590e6ae1cd041f6858295783d4f317bd017576d47c0e1d38f492b7

  • SSDEEP

    3072:qF6WIcanmoaKM9O8AZd3afnZhQsRMQnskw4d4F:4+hmoXM9OBZoZhrRMfT+u

Malware Config

Extracted

Family

redline

C2

65.108.29.210:21638

Attributes
  • auth_value

    ad39d6a8ea7823f2a92f57ebaa4c98a5

Targets

    • Target

      JaffaCakes118_4897c06dfc387d7f37803bc743c899fd

    • Size

      168KB

    • MD5

      4897c06dfc387d7f37803bc743c899fd

    • SHA1

      ecb53d5b850b0112b30eddda79aa8ad0d24705ad

    • SHA256

      26e0ed9fb2128e8290310478202ab919cb803ef83cb3d749f96498d94f4d1607

    • SHA512

      e5c78c0ce52c6aa4e9d066a89fbc7cfa463cdcf3cbddb7ed240c4bce2613f9174c1df4583d590e6ae1cd041f6858295783d4f317bd017576d47c0e1d38f492b7

    • SSDEEP

      3072:qF6WIcanmoaKM9O8AZd3afnZhQsRMQnskw4d4F:4+hmoXM9OBZoZhrRMfT+u

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks