Extracted

• • Target
    1dcb9de2a927f7a92cab50ae7f1fcb89
  • Size 381KB
  • SHA256 a54dde0dc6ffea45c28341a5b52a3afbd586d8e192c55f72658b52a490dd56c1
  • MD5 1dcb9de2a927f7a92cab50ae7f1fcb89
  • SHA1 fa793ea20de185899468f68f39463b0b1b553014
  • SHA512 bcb34a4b3788ea4718105a8f7ff39e328b5ad195217859d3f475694777efc92b43e53add877f2e07657e94951be09352d980e34a85e310c0cc38fdebdc94f578
  • SSDEEP 6144:MEgjAuwKe9i8BvavjjPYnZZTCkmJs3t/kG3YdTdIXUFnDHiMS5T8x1jkqdL9tfZL:2jZ8BGLQv+kmm3t/kDcInDHy6L9tfZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectoprat@red9xxevasioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2