Extracted

• • Target

    Invoice#577595955858.pdf.exe

  • Size

    2.0MB

  • MD5

    a687593ca5cf9d3fee446f7925272818

  • SHA1

    d8ec9e79259cb12c088a668afe34c4305f187c61

  • SHA256

    cbda14adc5ddc1c7dcaab3718dd25805b8c0b720db8678715a754754a214e05f

  • SHA512

    55250b2019b4ee49b8eec2b83fa48d178f2395afd97744f806c795f56d26a39d2be03f61af38ebea73cf4e5c066709026ae4073bc95e3e37062cdc90f14a6be9

  • SSDEEP

    49152:PB0m0c8A4WdMLE8Q7P0A4iDruQzwXOhR0kLZFs7+:Z07c8r1E8rA4iDruQzwidi7+

  Score

  10^/10

  persistenceredlinesectopratijelediscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2