Extracted

• • Target

    JaffaCakes118_0823571bf2ec2fe312740dfb557536d1ee59b62e502e81d4e8f577e702514c59

  • Size

    747.6MB

  • MD5

    97deb4fcf4c69ab166fd1301455b5dfa

  • SHA1

    0ff0b92ea0c7a7e1a0e9e25415a45afe81731d58

  • SHA256

    0823571bf2ec2fe312740dfb557536d1ee59b62e502e81d4e8f577e702514c59

  • SHA512

    16d83960c7f4fe98031a13a889a3fa994fe504f7300acb251bb6e819327448da8ff4ddc59ee8efdada34cd025a3e4b89f24a7f89dcd3e6b543338a9da6ab5e9b

  • SSDEEP

    12288:BLotIV4X2N9Ogad7pPnJvVKBenSvq33OKjmhI9YSb1jnWLsUmVw3kEun6dHS:Uc4X2TcNpPJdKUiAO8ivMjWLsRV

  Score

  10^/10

  redlineppiinstalldiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2