General

  • Target

    JaffaCakes118_a63c1406f48c254543abb50e5d17955e

  • Size

    518KB

  • Sample

    250108-xlbzksypc1

  • MD5

    a63c1406f48c254543abb50e5d17955e

  • SHA1

    87e5f30f65f54fe10120b9e1514ac5a5bd6c3c30

  • SHA256

    70b972f0c777521684a8b399e10baff6b742a8d7ccc80c31394df58d4e9fad3b

  • SHA512

    d83d2c489b1f0be8c9eee67b7b2af131a66c29b639717a4284e2026a94d4d05d43105d2575b24466b9fad299ab37f6b4a05ce4bed64e1e177327674c1c38d2cd

  • SSDEEP

    3072:nhkZ1ccW0Cm4iQqgz95EKVPOFWc3Cm/0OWfAe63TYcoc+acQ:nhkZPrl4iXgzgU2YZTjDDfaf

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_a63c1406f48c254543abb50e5d17955e

    • Size

      518KB

    • MD5

      a63c1406f48c254543abb50e5d17955e

    • SHA1

      87e5f30f65f54fe10120b9e1514ac5a5bd6c3c30

    • SHA256

      70b972f0c777521684a8b399e10baff6b742a8d7ccc80c31394df58d4e9fad3b

    • SHA512

      d83d2c489b1f0be8c9eee67b7b2af131a66c29b639717a4284e2026a94d4d05d43105d2575b24466b9fad299ab37f6b4a05ce4bed64e1e177327674c1c38d2cd

    • SSDEEP

      3072:nhkZ1ccW0Cm4iQqgz95EKVPOFWc3Cm/0OWfAe63TYcoc+acQ:nhkZPrl4iXgzgU2YZTjDDfaf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks