General

  • Target

    JaffaCakes118_9b4b76fc942b94f80abd4e8893443d37

  • Size

    4.6MB

  • Sample

    250108-mrb7esynfk

  • MD5

    9b4b76fc942b94f80abd4e8893443d37

  • SHA1

    e152fb08c25519d0e27977c57ca131cc4203600f

  • SHA256

    286f6ea3d502363b6bfde4f73aa50f75a6569158b9b4a920414adee1b8dae164

  • SHA512

    049c1a27fe61f515145fec9887c1bce6077973423abc5e80588a81acf38927de147ad6de1feb9424622f09c235f11d65e691951c35a90f67a20165b86eb68af8

  • SSDEEP

    98304:4LmDXxsBZXpB6J5K1LoZkc2O8dzTDw5fWQ3dn8U3JJ9BL:luBtuJOoLVorwNWQ3dn8U3vjL

Malware Config

Extracted

Family

redline

Botnet

@dalbaeb2228

C2

190.2.136.29:15554

Attributes
  • auth_value

    c3619bd2b5611a61169719e72acd942d

Targets

    • Target

      JaffaCakes118_9b4b76fc942b94f80abd4e8893443d37

    • Size

      4.6MB

    • MD5

      9b4b76fc942b94f80abd4e8893443d37

    • SHA1

      e152fb08c25519d0e27977c57ca131cc4203600f

    • SHA256

      286f6ea3d502363b6bfde4f73aa50f75a6569158b9b4a920414adee1b8dae164

    • SHA512

      049c1a27fe61f515145fec9887c1bce6077973423abc5e80588a81acf38927de147ad6de1feb9424622f09c235f11d65e691951c35a90f67a20165b86eb68af8

    • SSDEEP

      98304:4LmDXxsBZXpB6J5K1LoZkc2O8dzTDw5fWQ3dn8U3JJ9BL:luBtuJOoLVorwNWQ3dn8U3vjL

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks