Extracted

• • Target

    JaffaCakes118_fcd6f9dc4c2dedb09f02e98ae484275c

  • Size

    2.3MB

  • MD5

    fcd6f9dc4c2dedb09f02e98ae484275c

  • SHA1

    3caa9da0bdd2d95f9e4f2293e16fb3f0609c0aa1

  • SHA256

    2b8dd6e401df9a624a3255fce908ac384eb3013d69651c0d133521e2409cbdf9

  • SHA512

    e790c7d0af673e4c6c414b27af5fdd894708f31c03943ff2f5d2f28c2c0f261e62c86fd177228c524eae28d450c8934f3b0ca2f117aad2b87c7c21e935b2ece5

  • SSDEEP

    49152:25+hF6ujRlg2cvPauujSAzH9GsnfBgh2Px5ej75/xiz8lVHTIioOFZQ+R:25aF6ujRmFDAz9fBx5ev5/xiqZ7R

  Score

  10^/10

  redlinesectoprat@ditrcdiscoveryinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2