Extracted

• • Target

    e616360b2f0f67a471775b8a9ffabc42_JaffaCakes118

  • Size

    876KB

  • MD5

    e616360b2f0f67a471775b8a9ffabc42

  • SHA1

    bb8e91b082006117ba56ca3e1cf5b555da48a179

  • SHA256

    4541daa34997fc7c5f8e9cb8224f1059ff215965c2c33c597515ff293a8af3db

  • SHA512

    58215c5a1b0d9defb094aa694afe30d1c9b4a7ae0d8177560a8174555396504a92b390c25b75282a3327d0f358cd2d508c49a89e569387e4321c24fa5404c3ef

  • SSDEEP

    24576:nyLHuEU/Ve5SXJe8qXHgaKpr6gLUIpnK2ljS27vs:yLOgR3fgLPpyU

  Score

  10^/10

  redlinesectopratbuild2_mastifagilenetinfostealerpersistencerattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2