Extracted

• • Target
    JaffaCakes118_3e4f275636ebdd00154e6e2cb957a2cc
  • Size 628KB
  • SHA256 3123082ecf8fbb7ea839153b21ff31a63aec03296715f60ddab5b73867fe686c
  • MD5 3e4f275636ebdd00154e6e2cb957a2cc
  • SHA1 efaa6156e26b212f480d9db0fb21eb04b8b6cb97
  • SHA512 1628e90ff9db4d96f6704e203d6ed6dee2d5d8de9db1e83f25628dae77765af831c21fe4857d992777b8f0fb210b6dbc2becb76bdfa9cb346d13ab21d45bae54
  • SSDEEP 12288:3hxp3lZnT9bDyg3Ue03xVC8r84MMF+c9n5DI2FK:3Jlh9bDygCRr84Hk28
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  @obemeblytdefense_evasiondiscoveryexecutionredlinesectopratinfostealerpersistenceprivilege_escalationrattrojan

  • Modifies security service

    defense_evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2