Extracted

• • Target

    04b3c4c1abc6c8782dfb82ccb2d1ab95.exe

  • Size

    522KB

  • MD5

    04b3c4c1abc6c8782dfb82ccb2d1ab95

  • SHA1

    31a5080dfa9b9960689189e17fe885e97a791ce0

  • SHA256

    3810e8b72e0119c0d1af4f2c75582bc26899d654b913562e7c89fcb64fa7067e

  • SHA512

    62591fceddb08c63ab39c8384f6a3561d0d3f5066676fb9d7e3db458d3f61d6578fe6b6413c4431abc090276e2130d0081c3e9bd223225de43fe95d2e1872f35

  • SSDEEP

    12288:dMDit12s+bWqpNcXRNhs5R+D1PJsFoMUWS4Azfn5kekw214UGocZt7:qir2s+bHQ+zQ2Gt7

  Score

  10^/10

  redlinesectoprat@wulsomevasioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2