General

  • Target

    JaffaCakes118_6ad8f2b96d84135510c6fc31dece04b9

  • Size

    4.6MB

  • Sample

    250107-sxa47sxjat

  • MD5

    6ad8f2b96d84135510c6fc31dece04b9

  • SHA1

    be4d668cd8571a5aacbd9f2969ed095638decb69

  • SHA256

    283cbd908b318692fd0d95a811739739a3c349df08a1589da24e09ecaa1cb9e5

  • SHA512

    c7502f31901d8f0a37e49d9ca345b210c7e93732328a6d6acf6850a629e9913fd8262dd28ca34b9a3c6cbc9b49a7178d24565fc4630702863ea6c198e6de4fca

  • SSDEEP

    98304:oL5DrX3JnOCr6Sb8XzyeMaxdv2Pugn7/wOSAR8bxlwAIo:8xOCzbaWAx12PrMPoKT0o

Malware Config

Extracted

Family

redline

Botnet

onyxx

C2

185.255.133.25:18225

Attributes
  • auth_value

    e6ae87b99bc187e67e3023b8ad515104

Targets

    • Target

      JaffaCakes118_6ad8f2b96d84135510c6fc31dece04b9

    • Size

      4.6MB

    • MD5

      6ad8f2b96d84135510c6fc31dece04b9

    • SHA1

      be4d668cd8571a5aacbd9f2969ed095638decb69

    • SHA256

      283cbd908b318692fd0d95a811739739a3c349df08a1589da24e09ecaa1cb9e5

    • SHA512

      c7502f31901d8f0a37e49d9ca345b210c7e93732328a6d6acf6850a629e9913fd8262dd28ca34b9a3c6cbc9b49a7178d24565fc4630702863ea6c198e6de4fca

    • SSDEEP

      98304:oL5DrX3JnOCr6Sb8XzyeMaxdv2Pugn7/wOSAR8bxlwAIo:8xOCzbaWAx12PrMPoKT0o

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks