Extracted

• • Target

    ba9dcc325c94223a3a6b86a32e1b45a23cf61af6b360a678008c2f0e2a69a5c1.exe

  • Size

    405KB

  • MD5

    2211a370844148eeb489ad79ca40636a

  • SHA1

    bd25bc951d7c609bdd40ddfdb13533fe5facb4fd

  • SHA256

    ba9dcc325c94223a3a6b86a32e1b45a23cf61af6b360a678008c2f0e2a69a5c1

  • SHA512

    64f22905c739ea14b7bcdd0575caa7794e0f151223099f5680016680c2f99f83805a19cf128618a9077b35d3a95f3a2b013077fe91324e77b3d6e8fa99bfd9db

  • SSDEEP

    6144:65EuZhFKEW5iVlV1Q8jWA2pdpcX4hGRQhE9EsU5TqhMcOUdFfEsuABNueCgq:6pZhFSinvQ8jWA2psoh4+bssTTSuAJq

  Score

  10^/10

  redlinesectopratandiinfostealerratspywaretrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2