Extracted

• • Target

    0f368b05857b9c2f3fbf26fe0fbb4c96

  • Size

    875KB

  • MD5

    0f368b05857b9c2f3fbf26fe0fbb4c96

  • SHA1

    71104222e252c9257f8b752164078ca11c0175d9

  • SHA256

    b097f715296802798537d17ae47492d30be326e9dd54c87720c8dc04c7c33ab3

  • SHA512

    49776e26b5ae5c3a8897ab7718a65faf4ba403fa3bb4355535f3f1af0bf43095968ed72ddf4dae8f51c79f596631836362b4b78a21daa397a43b9241acefe6cc

  • SSDEEP

    24576:nyLHuEU/Ve5SXJe8qXHgaKpr6gLUIpnK2ljS27vs:yLOgR3fgLPpyU

  Score

  10^/10

  redlinesectopratbuild2_mastifagilenetinfostealerpersistencerattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2