General

  • Target

    JaffaCakes118_e24220a46bf73fca8bd64d4bf9e8b856

  • Size

    518KB

  • Sample

    250110-mtk74svlcm

  • MD5

    e24220a46bf73fca8bd64d4bf9e8b856

  • SHA1

    b70726bc14d35e956969f711e0e6fc71880e4612

  • SHA256

    ac9abaddb6cb8e92434eabeb01d2f4b58b130e0959208e1f02066449e9706ea3

  • SHA512

    532cf89baae92aceaa9c93be2ec68375497977f8e8d772734c8343add62d75167d1aff7b7a71ac6096bc4a5f5a034029e65aa185a38d9aa532930809a5ad9b88

  • SSDEEP

    3072:uU3Q5m5rdX4JcOkPqeWCCXv15V4qhzlLN7wKBpVI6dHbg:f3uYdX4J1k+CY1r4qhzDNVjdH0

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_e24220a46bf73fca8bd64d4bf9e8b856

    • Size

      518KB

    • MD5

      e24220a46bf73fca8bd64d4bf9e8b856

    • SHA1

      b70726bc14d35e956969f711e0e6fc71880e4612

    • SHA256

      ac9abaddb6cb8e92434eabeb01d2f4b58b130e0959208e1f02066449e9706ea3

    • SHA512

      532cf89baae92aceaa9c93be2ec68375497977f8e8d772734c8343add62d75167d1aff7b7a71ac6096bc4a5f5a034029e65aa185a38d9aa532930809a5ad9b88

    • SSDEEP

      3072:uU3Q5m5rdX4JcOkPqeWCCXv15V4qhzlLN7wKBpVI6dHbg:f3uYdX4J1k+CY1r4qhzDNVjdH0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks