General

  • Target

    JaffaCakes118_b70bb3fad75a6e2af8b3baf057642f99

  • Size

    4.6MB

  • Sample

    250109-bvzw4sskex

  • MD5

    b70bb3fad75a6e2af8b3baf057642f99

  • SHA1

    8d7d1fc03d10b6d3f2ec275b72a412ad33b2a761

  • SHA256

    6a1318ed15aac623dd355b43fe0be0112f4f64f32624b826a03bad585d23d2e1

  • SHA512

    e52c043f93f85211bea8ff1830e255bccbc39692fdb3ffc2484492af94c92ebb8d8bac14f3ef532cecd8e44400ef666e4226a8fe4cff40a47f5793a8a08491f4

  • SSDEEP

    98304:ULY0jDtCWyAS9bNw+zCAqcNIHr+oaTsWNTW+pN9yQ8wQ6gshnG:oCWyA4XNg+FTFTWAy1wQ

Malware Config

Extracted

Family

redline

Botnet

1109826361

C2

94.26.248.120:63731

Attributes
  • auth_value

    ee8187fd574be73a935e073f8b5705eb

Targets

    • Target

      JaffaCakes118_b70bb3fad75a6e2af8b3baf057642f99

    • Size

      4.6MB

    • MD5

      b70bb3fad75a6e2af8b3baf057642f99

    • SHA1

      8d7d1fc03d10b6d3f2ec275b72a412ad33b2a761

    • SHA256

      6a1318ed15aac623dd355b43fe0be0112f4f64f32624b826a03bad585d23d2e1

    • SHA512

      e52c043f93f85211bea8ff1830e255bccbc39692fdb3ffc2484492af94c92ebb8d8bac14f3ef532cecd8e44400ef666e4226a8fe4cff40a47f5793a8a08491f4

    • SSDEEP

      98304:ULY0jDtCWyAS9bNw+zCAqcNIHr+oaTsWNTW+pN9yQ8wQ6gshnG:oCWyA4XNg+FTFTWAy1wQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks