General

  • Target

    JaffaCakes118_9644d4aa71f09d365159c1ae308a873f

  • Size

    517KB

  • Sample

    250108-kjwvravlfm

  • MD5

    9644d4aa71f09d365159c1ae308a873f

  • SHA1

    b3cbc78e27ca40c4be016d3397f5d9bdaf90692b

  • SHA256

    1e662c6179de53bdffa5b4df2d0e0eb1fff276492391b1083f132583d4d3a7de

  • SHA512

    8843fe1977fbeb9dad3bec6aa2525ff6e1a6eff2bf04e849bcc3d620b2cb7de7f20928f48563bfe5b50caf6e253c4cc6c04c7215784a0be93c23fa6abe653a23

  • SSDEEP

    3072:WRl7DFbojzBP39PrihAzJGVtBp1Aq+Z7o1ZHYoEkYnx+dz5dlUJ:WRRajzd39qAzUVtBAElG+XdE

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_9644d4aa71f09d365159c1ae308a873f

    • Size

      517KB

    • MD5

      9644d4aa71f09d365159c1ae308a873f

    • SHA1

      b3cbc78e27ca40c4be016d3397f5d9bdaf90692b

    • SHA256

      1e662c6179de53bdffa5b4df2d0e0eb1fff276492391b1083f132583d4d3a7de

    • SHA512

      8843fe1977fbeb9dad3bec6aa2525ff6e1a6eff2bf04e849bcc3d620b2cb7de7f20928f48563bfe5b50caf6e253c4cc6c04c7215784a0be93c23fa6abe653a23

    • SSDEEP

      3072:WRl7DFbojzBP39PrihAzJGVtBp1Aq+Z7o1ZHYoEkYnx+dz5dlUJ:WRRajzd39qAzUVtBAElG+XdE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks