Extracted

• • Target
    JaffaCakes118_293f50b5b2ddc5d17f12b2f80483093f
  • Size 1.9MB
  • SHA256 0b496a5ed888075aa67ddab386c40aff392b63d57d1a9c4567715b5b65f3da8e
  • MD5 293f50b5b2ddc5d17f12b2f80483093f
  • SHA1 33628bb5e23bbf065619b4a8a8109cf1d54d8e99
  • SHA512 6d3462005237b567ef9401ed10363658d5ca6832b5a890c8a958fd3d0445ea7981d3ea305342627c98cd5caaa2a723b781cca40a0a2c39fb7ac9b92b5ecfaa34
  • SSDEEP 49152:V3lGydqh3zuWCiNRDNfL33EjsKKbY32Xl3:5Ay8h3zukpEsKKbY3i3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bootkitdefense_evasiondiscoveryredlinesectopratinfostealerpersistencerattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2