Extracted

• • Target

    a04e240c6fa1a6fc1a727fafbc76db47_JaffaCakes118

  • Size

    663KB

  • MD5

    a04e240c6fa1a6fc1a727fafbc76db47

  • SHA1

    88f541b615fed427f7ca50ad548b86d717a94f45

  • SHA256

    f415b460b4dacb363a1d1b5da612a93264981c0fc492fe19018351025b737a1b

  • SHA512

    acf2e7102e3aa83e1c46e7df1768ca01398bfb2d9e5f3d792d6f05e56ca9219833134c958b2f553bc582bc8eb41e8654e65d923f44f6ed031db82faff0f050d3

  • SSDEEP

    12288:Tmrggr2P8OK/rluRMN+I1ZQ5j172+s6J2VrbAmIpQwTJsKqG9PxUYfaOK7:Ft1CE8Yns7

  Score

  10^/10

  redlinesectoprat@redjee1discoveryevasioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2