Extracted

Extracted

• • Target

    fba04ac6840b68018f2e34cb163cf37b_JaffaCakes118

  • Size

    415KB

  • MD5

    fba04ac6840b68018f2e34cb163cf37b

  • SHA1

    bb4991c7815bf2b1c2e411b4d7cf74261194d65f

  • SHA256

    775e884c62bdb526eb6a26abdd14221782ada4ba4a572741a78757d981e997dc

  • SHA512

    d04c749ff6a86c87e012d200720f0ebc9a661ef0b046f5436c8bba788d562e12d0566731163fecf95c532fb1217f51fcce2218805702a5263fdb374a30f747a5

  • SSDEEP

    6144:5dRVzSkGTxSLD8uq5CaOPs47bhqUdUtX+t49fkR05tvEAK7/QWzBWJ4:5hqxSLo5C1Ps4XhitX+t498RgtMAYdzB

  Score

  10^/10

  njratredlinesectopratfivemmmhackeddiscoveryevasioninfostealerpersistenceprivilege_escalationrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2