General

  • Target

    JaffaCakes118_e9d3c72fe983f995a365dba28b0d3e73

  • Size

    518KB

  • Sample

    250110-vy912asrfj

  • MD5

    e9d3c72fe983f995a365dba28b0d3e73

  • SHA1

    9b0e981d3e6892d4479c4f6d711d3db73d10a310

  • SHA256

    8b3c5357d5351c05f4c7dde9bc368972e2b9c70f7a3cce01d5e2dee8fd2561e9

  • SHA512

    a2090700d0ef056b02506734917c091ec7a86dfa97ebdc7935ba67e29961462ed92b069d4fe1d65b8ba1dba849487c8ce4deb3f04a32fcde96a835a5ee10206d

  • SSDEEP

    3072:lf3w8rV+GDbcCISidiZZZ4RSppGeJQSRHk6zTbi2kwIxJAx0ni1:h3j5A7Sp3RHk6ZTuAxSQ

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_e9d3c72fe983f995a365dba28b0d3e73

    • Size

      518KB

    • MD5

      e9d3c72fe983f995a365dba28b0d3e73

    • SHA1

      9b0e981d3e6892d4479c4f6d711d3db73d10a310

    • SHA256

      8b3c5357d5351c05f4c7dde9bc368972e2b9c70f7a3cce01d5e2dee8fd2561e9

    • SHA512

      a2090700d0ef056b02506734917c091ec7a86dfa97ebdc7935ba67e29961462ed92b069d4fe1d65b8ba1dba849487c8ce4deb3f04a32fcde96a835a5ee10206d

    • SSDEEP

      3072:lf3w8rV+GDbcCISidiZZZ4RSppGeJQSRHk6zTbi2kwIxJAx0ni1:h3j5A7Sp3RHk6ZTuAxSQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks