Extracted

• • Target

    d36f9f85b593eff9501abd1110f0e3ad_JaffaCakes118

  • Size

    484KB

  • MD5

    d36f9f85b593eff9501abd1110f0e3ad

  • SHA1

    35e17561c3fff24d197823aa223ec263e7145924

  • SHA256

    dae470f530f6af1882d7e0250003ebfbb849ea4ef1bd6ffe5b10cf49e622d161

  • SHA512

    514b8a86f13abd7e4864c92f872ce94d3df641f00a45d64ffd6704db10f065f84ca12fc315fcddc995d8bb4afda0cd542aa5d68ee207db819211f888b4396f24

  • SSDEEP

    6144:ufWbL6qWhszuvff147FHkdqhi5o1rOlPXj2r439tojSvdH7TC6:u26qqqJEdqhyo1SlPMstoWvx3C6

  Score

  10^/10

  redlinesectoprat@x50x50x50x50defense_evasiondiscoveryinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • System Binary Proxy Execution: Regsvcs/Regasm

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2