General

  • Target

    JaffaCakes118_8d2cdc6c57daf506152a27ff3f23dfc3

  • Size

    382KB

  • Sample

    250108-fvmc8sxqfr

  • MD5

    8d2cdc6c57daf506152a27ff3f23dfc3

  • SHA1

    1150a9ffed21645fbb7be7ccafe2f51eb48f0f5e

  • SHA256

    9e3d545f1b9370c7db1ebae8cd94c718f61feb11288de53c04373032491bb23d

  • SHA512

    0c85805464ee9b7d5851ffaf96b2b98d4610cc5db4048ac1f334aea917263f24638bc49c0aba639e455f60d542b2cefe25c9a60c36ca37bcd04f664b3e5710df

  • SSDEEP

    6144:Zwhm1Xp5+04PXa3mWOq/Yk63o/Bm5gVCF:iQ1Xp5X4PXa3mWOq/p63o/Bm54CF

Malware Config

Extracted

Family

redline

Botnet

YTube

C2

195.2.93.155:17354

Attributes
  • auth_value

    4417d112a2503e368d8855f260c962d3

Targets

    • Target

      JaffaCakes118_8d2cdc6c57daf506152a27ff3f23dfc3

    • Size

      382KB

    • MD5

      8d2cdc6c57daf506152a27ff3f23dfc3

    • SHA1

      1150a9ffed21645fbb7be7ccafe2f51eb48f0f5e

    • SHA256

      9e3d545f1b9370c7db1ebae8cd94c718f61feb11288de53c04373032491bb23d

    • SHA512

      0c85805464ee9b7d5851ffaf96b2b98d4610cc5db4048ac1f334aea917263f24638bc49c0aba639e455f60d542b2cefe25c9a60c36ca37bcd04f664b3e5710df

    • SSDEEP

      6144:Zwhm1Xp5+04PXa3mWOq/Yk63o/Bm5gVCF:iQ1Xp5X4PXa3mWOq/p63o/Bm54CF

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks