General

  • Target

    JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06

  • Size

    212KB

  • Sample

    250109-s1ea2avrbk

  • MD5

    cbd7947fba2fdb2fa1ed44f434216a06

  • SHA1

    ac28ba8580612df9b63084297a027c4597135399

  • SHA256

    4dfa820522a5a5bbbd36d4a95e13fb1d61a128f4b88a2c1c4aca6bc9d9afa0e5

  • SHA512

    e8c623bc681a0342b33d5858a395fb766a1e041f55c4d8c783774032db9ebe417639a8fafef1fde5542d41dff548481eb0e928505c6b7f6488564192702cc077

  • SSDEEP

    3072:uoN5Fb9KM4FcYLwd5aAWvOvQ3aIoWPp+aG:uob/v4FcN5arvIQKjWxU

Malware Config

Extracted

Family

redline

Botnet

@mersedesoc

C2

51.91.193.177:18717

Attributes
  • auth_value

    74a8f00abc3c55d9a0655f0cea4e3580

Targets

    • Target

      JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06

    • Size

      212KB

    • MD5

      cbd7947fba2fdb2fa1ed44f434216a06

    • SHA1

      ac28ba8580612df9b63084297a027c4597135399

    • SHA256

      4dfa820522a5a5bbbd36d4a95e13fb1d61a128f4b88a2c1c4aca6bc9d9afa0e5

    • SHA512

      e8c623bc681a0342b33d5858a395fb766a1e041f55c4d8c783774032db9ebe417639a8fafef1fde5542d41dff548481eb0e928505c6b7f6488564192702cc077

    • SSDEEP

      3072:uoN5Fb9KM4FcYLwd5aAWvOvQ3aIoWPp+aG:uob/v4FcN5arvIQKjWxU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks