General

  • Target

    JaffaCakes118_eac6616c87de243a970eb5c7a21b48b2

  • Size

    4.6MB

  • Sample

    250110-wt9eda1qgv

  • MD5

    eac6616c87de243a970eb5c7a21b48b2

  • SHA1

    a5ea8f489d11ed9a465809412ecbbaea32f339a3

  • SHA256

    5fa48fe33f43d5aecbdc5cc8dc4229e479944ad29c0543a234ce0c9d68d4cdc5

  • SHA512

    ab2ad2d504a320341b54ee3bf01a9deba3d9b984c4a26111d2d91674388e23f14ddfa3cac264e6132c461df7ff6c0a23ed798584dc0a8f951292acd04e208832

  • SSDEEP

    98304:TLKbhJUQMWPKsYSm66yyDjmWfeIj9VSR2GJ1DK472TrniEUzZx:eASmFBDj5fOnf0OF

Malware Config

Extracted

Family

redline

Botnet

@kiirek

C2

5.188.118.163:80

Attributes
  • auth_value

    9bde7608ef33d6cbd8c01687cdd53196

Targets

    • Target

      JaffaCakes118_eac6616c87de243a970eb5c7a21b48b2

    • Size

      4.6MB

    • MD5

      eac6616c87de243a970eb5c7a21b48b2

    • SHA1

      a5ea8f489d11ed9a465809412ecbbaea32f339a3

    • SHA256

      5fa48fe33f43d5aecbdc5cc8dc4229e479944ad29c0543a234ce0c9d68d4cdc5

    • SHA512

      ab2ad2d504a320341b54ee3bf01a9deba3d9b984c4a26111d2d91674388e23f14ddfa3cac264e6132c461df7ff6c0a23ed798584dc0a8f951292acd04e208832

    • SSDEEP

      98304:TLKbhJUQMWPKsYSm66yyDjmWfeIj9VSR2GJ1DK472TrniEUzZx:eASmFBDj5fOnf0OF

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks