General

  • Target

    JaffaCakes118_c05b6c84b172b2f271081a4a5f3a7975

  • Size

    4.6MB

  • Sample

    250109-gjedxs1kby

  • MD5

    c05b6c84b172b2f271081a4a5f3a7975

  • SHA1

    e176e9e9fc07321e93531a093e9e4d632e06df93

  • SHA256

    a5f06c44ed529d7560c06b5be1501f16173c582a0352efa51f86f966df437d77

  • SHA512

    c0b7d6746d8e2eb6fde1ce62339df627300df43791d214a863bd346697e7a618b474e25f1d0c3dd406761d098145fe0287564a254481c66cd2c0115191e26d5b

  • SSDEEP

    98304:NLBTDtkZaxOcEQudGRxQ+iBlmKVek6ZczBavYvSU6ra1N8LSESr1l:xkMzsdGPwmKgP+jTNDJ

Malware Config

Extracted

Family

redline

Botnet

@uuunder

C2

138.124.186.121:45760

Attributes
  • auth_value

    9b509f3ca2ec2a739920d789362e5ac4

Targets

    • Target

      JaffaCakes118_c05b6c84b172b2f271081a4a5f3a7975

    • Size

      4.6MB

    • MD5

      c05b6c84b172b2f271081a4a5f3a7975

    • SHA1

      e176e9e9fc07321e93531a093e9e4d632e06df93

    • SHA256

      a5f06c44ed529d7560c06b5be1501f16173c582a0352efa51f86f966df437d77

    • SHA512

      c0b7d6746d8e2eb6fde1ce62339df627300df43791d214a863bd346697e7a618b474e25f1d0c3dd406761d098145fe0287564a254481c66cd2c0115191e26d5b

    • SSDEEP

      98304:NLBTDtkZaxOcEQudGRxQ+iBlmKVek6ZczBavYvSU6ra1N8LSESr1l:xkMzsdGPwmKgP+jTNDJ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks