Extracted

• • Target

    5e8dcae075afd996063cbb627772df5e_JaffaCakes118

  • Size

    3.8MB

  • MD5

    5e8dcae075afd996063cbb627772df5e

  • SHA1

    14f9ea57199c25ebdc10aa8bc2829b20f8c6b36e

  • SHA256

    e7b6c387d12e6779f5ab33db7c4fcbb57d9b8c607a78d2b2f7d6440ceaa6d9c1

  • SHA512

    ae6a0e7a4e8f8453e7d02e74b2de268f1cf5339f6ec826880078e087e4dfbe4c1cf6343f74508083668a09004c244289318125cea5d0baa1dd7535b7deb7a4ce

  • SSDEEP

    49152:3UnNK955OUWaYU+7pvjkuke7+AD8zAtFNW1C7eDwuODZqW0qrH41AKvI:kk558UQ4ukSDG2kDwuOVf0qSAK

  Score

  10^/10

  redlinesectopratwsapppdiscoveryevasioninfostealerratthemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2