Extracted

• • Target

    JaffaCakes118_a8599b9ee6ab5e391788b7e8f183a858

  • Size

    3.0MB

  • MD5

    a8599b9ee6ab5e391788b7e8f183a858

  • SHA1

    d01e832effb7eca779d5387b139925a69fa5f07b

  • SHA256

    00d617e50b3665427f5558404dbaeaac2b55b8413c75ef2e054e532d1d240270

  • SHA512

    cac68e88da9b7f248236678a858d930f1f02b1534d5fc0b1d197fa36540d4b6d74571180c07b0c59cf0356d2951dae4d5dd3a7158a4fe1bb50fa8d7929d239ba

  • SSDEEP

    49152:K94vrZ5XjXmuvZ/vT5A+kCT3dLRI/l4+txZty1GHY+ExwvfZI3kEN5CJfFFIpe:2ofzmuhHTAChFINJQ128wnO3V5WfF6pe

  Score

  10^/10

  redlinesectoprat@xmrfraudboydiscoveryevasioninfostealerratthemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2