Extracted

• • Target

    JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632

  • Size

    4.0MB

  • MD5

    f600d5e0f9a95a876b9887dd00fc6632

  • SHA1

    4219643d72cd0d5c4b50dcee3326a2d41e5d225e

  • SHA256

    8dc33fa00c5081233fa79e35c7de7bb9769e280f245401dbede7a7d02969b0ba

  • SHA512

    2bcd36d7cc4b704d5bf03221ea4b27d9c77c3f3524829570282cc19118db728decb80a0822216e8a00d93ce09ca3e553778ce7178b848aac0af11dece426e0e9

  • SSDEEP

    98304:LW0Ep9I8UCCQ7b6rAVsq2/zYvMvLvRXiheE0gHv/zL:Ea5CCu6rA6qTvcRVZgHvLL

  Score

  10^/10

  redline@f1gasebediscoveryexecutioninfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    $TEMP/Minsteryard.exe

  • Size

    3.7MB

  • MD5

    1ad3029c8d2a4757628b99efc75a87ef

  • SHA1

    3a6164f653bc11c303c98716764c443fe651b6e8

  • SHA256

    9b7b1e2944d31e405a7d72a08ecf193f509ff52e5670f6813be986ac9ff65ecc

  • SHA512

    f097481515d99e7ddf11fbd09c004c5286e3857fb1fb2c9305a4e491611690f4cf61303654802545a9259762fc1ba18845185ac651d06cdbf83db19133cf0bbe

  • SSDEEP

    98304:beGWFH8Yi0OaTH238L6O2vteL8vxzxBe7SIMg+W:OcV0OE238GOZLK3JNg+W

  Score

  8^/10

  execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral3behavioral4

• • Target

    $TEMP/fYxbPKoziOFe.exe

  • Size

    839KB

  • MD5

    9de8c7cb28923bbe39c5c668eae0f21f

  • SHA1

    1f4d88fadb7648033c16a983376e96ce2f7b0039

  • SHA256

    844f5a9d5b9b4a552325449601071e0ecf449b04232ec16ddffe03ae404fc8a4

  • SHA512

    d2f310f98551207b1842d307cf17a1a175676b92cecde885d66b2b58e34da7664ca4e007a724bcb4bda35b10f4b8f0dec81bbe59f9ee3d07915c75eb37257278

  • SSDEEP

    12288:YL7CSb2gLre1WYMEUSILvWdbGSexg+rrMgpAz47kDLj/BRsDklNsSa:27rPfeECUbLAneq06uk/j5Rs4lWSa

  Score

  10^/10

  redline@f1gasebediscoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline
  behavioral5behavioral6