General

  • Target

    JaffaCakes118_b58e6b6e3dd0ab7dc2bd6cdcec4d685f

  • Size

    4.6MB

  • Sample

    250109-a41z4azrfv

  • MD5

    b58e6b6e3dd0ab7dc2bd6cdcec4d685f

  • SHA1

    47dbe326a072d1c1e019994c9827c98b6aad6d1b

  • SHA256

    280e25702f34e2bb2d551bcedc96f8418fc680f195c4fdda2dccb247e8d5a5ef

  • SHA512

    80c95dc78134c3a9e6385a89750b7634d641f7ecd74060058ef6cf747dbcfd1e9a6e5e898dbaf5625b60659d9b3c8a58e2d31252d251db851f544dbef9b6afeb

  • SSDEEP

    98304:mLyenIDTWL73IuqwmEOKZR5L1uZOJMG8SunPTd:RvWL73Iuq9KZjhXCnPT

Malware Config

Extracted

Family

redline

Botnet

@Free_Reall

C2

185.209.22.181:29234

Attributes
  • auth_value

    5a0918bd3e8ede8e02c8dd9d106a996d

Targets

    • Target

      JaffaCakes118_b58e6b6e3dd0ab7dc2bd6cdcec4d685f

    • Size

      4.6MB

    • MD5

      b58e6b6e3dd0ab7dc2bd6cdcec4d685f

    • SHA1

      47dbe326a072d1c1e019994c9827c98b6aad6d1b

    • SHA256

      280e25702f34e2bb2d551bcedc96f8418fc680f195c4fdda2dccb247e8d5a5ef

    • SHA512

      80c95dc78134c3a9e6385a89750b7634d641f7ecd74060058ef6cf747dbcfd1e9a6e5e898dbaf5625b60659d9b3c8a58e2d31252d251db851f544dbef9b6afeb

    • SSDEEP

      98304:mLyenIDTWL73IuqwmEOKZR5L1uZOJMG8SunPTd:RvWL73Iuq9KZjhXCnPT

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks