Extracted

• • Target

    0d4a1bf4499f0c9cf1c18f2b9fe49cae.exe

  • Size

    523KB

  • MD5

    0d4a1bf4499f0c9cf1c18f2b9fe49cae

  • SHA1

    8934cdbe0e81b7d7065dc7b77b969e6254314c97

  • SHA256

    d11e908a52a5e59e1b562477071a0eea0b1400a4468d506036ead82f3bfffafe

  • SHA512

    387d124040deb179514953078bd48f0a5cbbe714f64b5155942a597d51aa18d6305c809c2375587c85f095877e39605aec33fe7632b3a588bdc22bf0baec9f9f

  • SSDEEP

    12288:K2bn8tvQ8F4p4pTcxOjpzbjduHgkI0mAHg:G9pMOdLduAkZmA

  Score

  10^/10

  redlinesectopratcheatinfostealerrattrojandiscoveryspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2