Extracted

• • Target

    a88f8701c522009f59a1b06bc9d9af13_JaffaCakes118

  • Size

    1.2MB

  • MD5

    a88f8701c522009f59a1b06bc9d9af13

  • SHA1

    f1d7ebf13829a1bf8a27fdd4e566e95ba37027cd

  • SHA256

    363a487add254cf5341fd303326dc9969d90b85fa60f753f578342f32ba075bf

  • SHA512

    22972912ca7e449607440406eea53d3e72fb128f08ffc6a69612aa6d61756df3a433b47c0b0f86ecdb00d448cc93887cb899ed529e9fac62159eddbc592d9b23

  • SSDEEP

    12288:8jLnlQc2iNJFYa4mDrGeKbgPCLEuTDaozf8wCD+HLEhe1PR6FkVPRHg+vjjBuS9u:8p1DF14mDCeK3EunKD+vR/PBvjjBuY

  Score

  10^/10

  redlinesectopratonyxx4discoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2