Extracted

• • Target

    JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3

  • Size

    5.0MB

  • MD5

    f1a639dcfdd0f5637f5666802ee379e3

  • SHA1

    025bc9f4f4c27df34adc1e99e4aad668d93008c4

  • SHA256

    26cb0502561e27e0009406c727aabaf50e476fc570baa995b6d2582d84ef8931

  • SHA512

    aa72d783099bf160bd6af18106ebe24625491e7a90f94dcfe0b690d10210c3e7fd9eacbed5ff34302191b38d5273568ad1d19d124c784cefa213ba873cfaa684

  • SSDEEP

    98304:JigoF29Se5bo/R5v9jQE2dftU0C4XzNaKhC9agopRyWb:QVeSObo/zFQdU0DzjGIpRyO

  Score

  10^/10

  redline@turbo_installdiscoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2