Extracted

• • Target

    e222be0565282bbd796d02f502b3940e_JaffaCakes118

  • Size

    2.3MB

  • MD5

    e222be0565282bbd796d02f502b3940e

  • SHA1

    e3f8f52b25d2e9d32ec0b1fa66fab8979c84be3a

  • SHA256

    325e22d8dba548d64047458fde7d8dda2fcfcc1e711f0dc46630c9750dd4ea9f

  • SHA512

    947bd604839ba08cc95018bbeb2c18473ea86a52814f3bd8d8d9cb4e478735253d34e83bfa7cdd06a8524b0b3124ed6c373cd4eb17cf3b4397cba90abcc3a6df

  • SSDEEP

    49152:55+hFiL/0cAr+wWZVuxTrm2PUf26RUSVT3MIUlf2xiz8lVHTIioOFZQ+0:55aFiL/07SwWZAx3Vcf2UZ62xiqZ70

  Score

  10^/10

  redlinesectoprat@p1pk466discoveryinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2