Extracted

• • Target
    0602d74b76caa2200b12f83c8a77b617
  • Size 1.1MB
  • SHA256 c81ccfef5ce97e9647b89a79b4adbdb73feceea4c8ed0fa88b33f02e52859b8f
  • MD5 0602d74b76caa2200b12f83c8a77b617
  • SHA1 d9b6aea303abac942f632459349a361cae9fa9a3
  • SHA512 e61268383629af097e3e7102ef917ea6355a3e16a33d46d1128b780d203fd6511d7f1f9ca977353eef64aa7c1cd7f32a133a1c04775176cae2f33f0ed16b35f7
  • SSDEEP 24576:O7WVBJ21Phu7NbcPEipoZDO7yeLa0kKA+Br/PWkZTRMA:IGFqEi2Za7/Lx3p/+SB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2