General

  • Target

    JaffaCakes118_ba3581cd235eec704cc63575f546cebc

  • Size

    211KB

  • Sample

    250109-depsbaxqbn

  • MD5

    ba3581cd235eec704cc63575f546cebc

  • SHA1

    529634b8285edf381b27cd3adf369361f795b59a

  • SHA256

    a7ee4b81780bf55a3da4a984a35563b20441f5b0a618771882ae1e4000b4d941

  • SHA512

    c1dc71a22d822198e9832dbb2490ecd74b2aa5e5cf42ff9aa385dc0d5ac01088d8f391d0cf22e132f857858a61e922d18c68199f0c8ef7c5d6d5b3a09bb3761c

  • SSDEEP

    3072:zVMAhQAtkOoCwQDbz/UZifg++ATH562VoKUZWcrenCtOYTq:5MAhjWq7PUZiN+90oKUZFreCLO

Malware Config

Extracted

Family

redline

C2

141.94.188.139:43059

Attributes
  • auth_value

    e6fd07a033474b6535552b6f7bfb4f97

Targets

    • Target

      JaffaCakes118_ba3581cd235eec704cc63575f546cebc

    • Size

      211KB

    • MD5

      ba3581cd235eec704cc63575f546cebc

    • SHA1

      529634b8285edf381b27cd3adf369361f795b59a

    • SHA256

      a7ee4b81780bf55a3da4a984a35563b20441f5b0a618771882ae1e4000b4d941

    • SHA512

      c1dc71a22d822198e9832dbb2490ecd74b2aa5e5cf42ff9aa385dc0d5ac01088d8f391d0cf22e132f857858a61e922d18c68199f0c8ef7c5d6d5b3a09bb3761c

    • SSDEEP

      3072:zVMAhQAtkOoCwQDbz/UZifg++ATH562VoKUZWcrenCtOYTq:5MAhjWq7PUZiN+90oKUZFreCLO

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks