General
-
Target
f9df3f04331d5c80bd48d57afc2645ca_JaffaCakes118
-
Size
403KB
-
Sample
240419-jyswzace33
-
MD5
f9df3f04331d5c80bd48d57afc2645ca
-
SHA1
dd43cad5bce92fb81cb8bc2842c804c43467a256
-
SHA256
367e84c0d4b69615c7086d24242186a7d4cedae2755c490f52c30608ec74a3a3
-
SHA512
33cab8295582ee0862a30475c7ebb1fa4899d340dec84fc94316dda1d97fa05ff48d7acf268abbd16e7c374c9d450d57de56e423297bc0ed4e3001dfc699dd76
-
SSDEEP
12288:D6lqZmWfFrKu+MWcHXBoThHwV4Cn9CCCCCCSCCCCCCCCCCCvCCCCCCCCCCCCC8pL:D6utp4Cn9CCCCCCSCCCCCCCCCCCvCCC7
Static task
static1
Behavioral task
behavioral1
Sample
f9df3f04331d5c80bd48d57afc2645ca_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f9df3f04331d5c80bd48d57afc2645ca_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
redline
65.108.29.210:21638
-
auth_value
ad39d6a8ea7823f2a92f57ebaa4c98a5
Targets
-
-
Target
f9df3f04331d5c80bd48d57afc2645ca_JaffaCakes118
-
Size
403KB
-
MD5
f9df3f04331d5c80bd48d57afc2645ca
-
SHA1
dd43cad5bce92fb81cb8bc2842c804c43467a256
-
SHA256
367e84c0d4b69615c7086d24242186a7d4cedae2755c490f52c30608ec74a3a3
-
SHA512
33cab8295582ee0862a30475c7ebb1fa4899d340dec84fc94316dda1d97fa05ff48d7acf268abbd16e7c374c9d450d57de56e423297bc0ed4e3001dfc699dd76
-
SSDEEP
12288:D6lqZmWfFrKu+MWcHXBoThHwV4Cn9CCCCCCSCCCCCCCCCCCvCCCCCCCCCCCCC8pL:D6utp4Cn9CCCCCCSCCCCCCCCCCCvCCC7
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Suspicious use of SetThreadContext
-