General

  • Target

    JaffaCakes118_54453a790722fad02b6be80e54277a9f

  • Size

    517KB

  • Sample

    250107-hvnx6s1rbl

  • MD5

    54453a790722fad02b6be80e54277a9f

  • SHA1

    3beb6c1a15ee4abea90d1155f4b795b576a7a5b5

  • SHA256

    e8677a10f830b2bb1bb24d7b0aa6bca09e96f15b819ec127ca02d31a02166210

  • SHA512

    c2e9309a210b14b7f27fe563940b03ec4bd5b1edd7c9d1cb5c775b9db535349973c639969845d0f7cb6dbcec0bd0d9e6c67fee02e30e0421dd3b5c56f84f4b06

  • SSDEEP

    3072:2sntJc4BAEoQmW+ipSKSwkjwLelL02oyPs7hwNXunlFpoyxL0:2stJcv1QmWDs2Lep0nyPeZWyxQ

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_54453a790722fad02b6be80e54277a9f

    • Size

      517KB

    • MD5

      54453a790722fad02b6be80e54277a9f

    • SHA1

      3beb6c1a15ee4abea90d1155f4b795b576a7a5b5

    • SHA256

      e8677a10f830b2bb1bb24d7b0aa6bca09e96f15b819ec127ca02d31a02166210

    • SHA512

      c2e9309a210b14b7f27fe563940b03ec4bd5b1edd7c9d1cb5c775b9db535349973c639969845d0f7cb6dbcec0bd0d9e6c67fee02e30e0421dd3b5c56f84f4b06

    • SSDEEP

      3072:2sntJc4BAEoQmW+ipSKSwkjwLelL02oyPs7hwNXunlFpoyxL0:2stJcv1QmWDs2Lep0nyPeZWyxQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks