General

  • Target

    JaffaCakes118_77fc57d18737d95b261885158de0db4e

  • Size

    517KB

  • Sample

    250107-zddvbazkal

  • MD5

    77fc57d18737d95b261885158de0db4e

  • SHA1

    efd686a0355b992f34bbce46b5fe14696375a5cd

  • SHA256

    ed49794dc79523c25a49053833afada7090b1da2c0fe2a725da8c9979c993432

  • SHA512

    262d86a319276e5ce28a79e89db67ebb76f55b0b3b2b0ce6236de421d6e4d5c8b778d1006bc26cc38dfd5326453360a8215ef4b3fe5140893d4f206a38094e06

  • SSDEEP

    3072:ef1fltoqP6j/we9Ffy8OGb6nfss1JYHENejxesYcfGFhk:ef1flqk6j/wuF53s/vhcfae

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_77fc57d18737d95b261885158de0db4e

    • Size

      517KB

    • MD5

      77fc57d18737d95b261885158de0db4e

    • SHA1

      efd686a0355b992f34bbce46b5fe14696375a5cd

    • SHA256

      ed49794dc79523c25a49053833afada7090b1da2c0fe2a725da8c9979c993432

    • SHA512

      262d86a319276e5ce28a79e89db67ebb76f55b0b3b2b0ce6236de421d6e4d5c8b778d1006bc26cc38dfd5326453360a8215ef4b3fe5140893d4f206a38094e06

    • SSDEEP

      3072:ef1fltoqP6j/we9Ffy8OGb6nfss1JYHENejxesYcfGFhk:ef1flqk6j/wuF53s/vhcfae

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks