Extracted

• • Target

    JaffaCakes118_8bb466d3688acf5c12679049d20e5db1df625504

  • Size

    661.4MB

  • MD5

    89673d5799b9408e0db75b1648fa5680

  • SHA1

    8bb466d3688acf5c12679049d20e5db1df625504

  • SHA256

    5e83d2559380d68372abdf290376a3e2d45eb7156c6820528a55ca3fa92dad09

  • SHA512

    46d36f9bf68f4181444c807c227f4a2e19421eb07e9ba246892b2ca5c1f41d0e4642f122bbebc3b8107c7906f965c4758716382abab66b5fd4d427dff7fb2521

  • SSDEEP

    12288:lQ7nzJ5vgpptM4Q4z7FR/qaJE+kPVcui7VHqmt0Wj:lQ7VWpXM4Q0F9qI6uuihKs

  Score

  10^/10

  redline150722discoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2