Extracted

• • Target

    C00DE8B488C9399F6104E5E4DA8BB326.exe

  • Size

    480KB

  • MD5

    c00de8b488c9399f6104e5e4da8bb326

  • SHA1

    41738e37f1aa7fe68f305f7c9f8e385c19761dd3

  • SHA256

    60543f63bdb95aa5eb03e848218983566c48fac35caa005209214b7ea70e5c09

  • SHA512

    669b01097afdf6e575a1267b01a2ba13c32954bd94c764adbeec237416524a36c11c54a1d30c2adf456ab9c7e4f24c2ca254791ee9157e9b3d98e4fe9dce2b16

  • SSDEEP

    6144:DGdOl/13jRFYTUn1S5ieek5lB+JfaLt2y0i1p6LtMeG+CVWt40yAE7kwzegKVW2Q:DGdgrYTU1oieb+JfaLx7eAVekze7eQp

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2