General

  • Target

    JaffaCakes118_76b9c753c5133d59ade0e315865d7b97

  • Size

    4.6MB

  • Sample

    250107-yt2qmsykdk

  • MD5

    76b9c753c5133d59ade0e315865d7b97

  • SHA1

    845c639a7e1f749161e671bf8c4b860a3a3eb029

  • SHA256

    b4312b6580e52e53c37de5125e292c6f0d0cff92774056ce7307fe37372885c7

  • SHA512

    30e1fb4a10fd29d89add8615620e0763f5c57260ac3177cfa191ec0a5204ce8c53f7fc5fc20d168ac140de16ff4633ec4f4ca60fde7927bf9661e7c3b0e859d5

  • SSDEEP

    98304:rLrQPdik3gPpBv+ZH3JL4Uvd5mEcvc1GU49/twafMmymlz:rxk3+L2Z2edAEck6/twaUyZ

Malware Config

Extracted

Family

redline

Botnet

fs

C2

185.255.133.25:18225

Attributes
  • auth_value

    e6ae87b99bc187e67e3023b8ad515104

Targets

    • Target

      JaffaCakes118_76b9c753c5133d59ade0e315865d7b97

    • Size

      4.6MB

    • MD5

      76b9c753c5133d59ade0e315865d7b97

    • SHA1

      845c639a7e1f749161e671bf8c4b860a3a3eb029

    • SHA256

      b4312b6580e52e53c37de5125e292c6f0d0cff92774056ce7307fe37372885c7

    • SHA512

      30e1fb4a10fd29d89add8615620e0763f5c57260ac3177cfa191ec0a5204ce8c53f7fc5fc20d168ac140de16ff4633ec4f4ca60fde7927bf9661e7c3b0e859d5

    • SSDEEP

      98304:rLrQPdik3gPpBv+ZH3JL4Uvd5mEcvc1GU49/twafMmymlz:rxk3+L2Z2edAEck6/twaUyZ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks