General

  • Target

    JaffaCakes118_734f1948559848a3780fb6e955200380

  • Size

    170KB

  • Sample

    250107-xche1avpfm

  • MD5

    734f1948559848a3780fb6e955200380

  • SHA1

    19397e214ae946c304783b65ea513c0a89acb51b

  • SHA256

    821034aaaad60a1962e72c0319f6916faffa276e386a87f9654f0c1e6eab9e23

  • SHA512

    b3e84c0ad7780ab57d015d20cb10e868c7780bc81e682d11eaef344461ba1fdd5d297b96a439472b108d7cfc5d58544e9a5312d1e5b83f678536065d542c9ff9

  • SSDEEP

    3072:u+Ge88jB8uexk8pBnvfBAen25HipDzHSa+L5x/oT51Hwrh7+iONW:1jDekK5vpUuH0dI1H9Js

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_734f1948559848a3780fb6e955200380

    • Size

      170KB

    • MD5

      734f1948559848a3780fb6e955200380

    • SHA1

      19397e214ae946c304783b65ea513c0a89acb51b

    • SHA256

      821034aaaad60a1962e72c0319f6916faffa276e386a87f9654f0c1e6eab9e23

    • SHA512

      b3e84c0ad7780ab57d015d20cb10e868c7780bc81e682d11eaef344461ba1fdd5d297b96a439472b108d7cfc5d58544e9a5312d1e5b83f678536065d542c9ff9

    • SSDEEP

      3072:u+Ge88jB8uexk8pBnvfBAen25HipDzHSa+L5x/oT51Hwrh7+iONW:1jDekK5vpUuH0dI1H9Js

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks