Extracted

• • Target

    40a723a491c97d0146a3582b5147d1d5_JaffaCakes118

  • Size

    408KB

  • MD5

    40a723a491c97d0146a3582b5147d1d5

  • SHA1

    2a2594d4c51711d5bffe8acc55e7f5debfb2440c

  • SHA256

    3c2ec2463bbc8bae60ee8bac17aebc816561ad045bfdb25c09953a9f935d9ad6

  • SHA512

    faa0750823dbeb97393c4b7dbfe86fc6913714e8d9652b2d8198de0697ea3507368615f7f26c42075b0be08a1a384b954bd560e52e9bfa855656efcb9b3773e0

  • SSDEEP

    6144:ZiF2L74EgvJ6qSz+pWp+FrSgd0zqqUHkaN4yDcYz6RM9AoNvapJzNe6vQ7xdD9nO:jhgMyIp+ZSgddHuiL1apB/vQ7xDBEIK

  Score

  10^/10

  redlinesectoprat@limak22discoveryinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2