Extracted

• • Target

    97741a79207f48e8b4af97d55b2517c4_JaffaCakes118

  • Size

    981KB

  • MD5

    97741a79207f48e8b4af97d55b2517c4

  • SHA1

    5576a8f522a5b6bfc8e88ecd075f4129521fd318

  • SHA256

    0bb268d4febfaecaa8b740a62f7225cb1234726b3a529828ca54e54a5144d056

  • SHA512

    f00e625b40b3bb1581c04ec9cdcefb3c7ff4e4148d60f5dc47a9d1056be1f214ce0b68f3d91ca624bc7570efd2632e2bc05fadea526464dc920e58d4525de4b1

  • SSDEEP

    12288:wC9lxzF32iN02sYU9k1YZ9P56TEaHa3CwHIb9jh3bUTcd5lLR:Lt11sL9BVa63CZfUTcf/

  Score

  10^/10

  redlinesectopratdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2