Behavioral task
behavioral1
Sample
JaffaCakes118_f1d5961147378731f63effa7c1f19c40.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f1d5961147378731f63effa7c1f19c40.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f1d5961147378731f63effa7c1f19c40
-
Size
104KB
-
MD5
f1d5961147378731f63effa7c1f19c40
-
SHA1
3b893c54a83ec7b985ed06abf667c4ded12865ad
-
SHA256
1ef750e56b5287f02e9f7289b8216a7a8de9125f131f76ad4652ea2693c87829
-
SHA512
30396b363d9fb08fc63cb1cc7eebc890cd384ae20d12b825c8bba32831e3e316071aac9b3810879b962cbfafe5f2177c3448962468ec9bff0bb9868ab03f913d
-
SSDEEP
3072:eBECs7bLjlp5qjW/uyX/Gk7OlfPR2IJv8D7:FTbLjlp5qjWBvKLqX
Malware Config
Extracted
redline
@exs1temq
62.182.156.24:12780
-
auth_value
bb67ccc49d44343128ca161d7fe51029
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
JaffaCakes118_f1d5961147378731f63effa7c1f19c40.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
42:6d:a3:70:0c:c1:43:a2:4e:3c:cc:e8:4e:42:9e:a7Certificate
IssuerCN=Septennial,O=Meekened Reny Inc.,C=E4,1.2.840.113549.1.9.1=#0c1770616c6176657273736d6f746540676d61696c2e636f6dNot Before14-10-2021 21:00Not After21-10-2031 21:00SubjectCN=Septennial,O=Meekened Reny Inc.,C=E4,1.2.840.113549.1.9.1=#0c1770616c6176657273736d6f746540676d61696c2e636f6d09:f2:8a:e1:89:a8:a3:b7:9d:4d:c5:7a:52:b2:07:78:f7:dd:97:b9Signer
Actual PE Digest09:f2:8a:e1:89:a8:a3:b7:9d:4d:c5:7a:52:b2:07:78:f7:dd:97:b9Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ