Extracted

• • Target

    420b5e0a40b576da5f8c7898777b19bf

  • Size

    988KB

  • MD5

    420b5e0a40b576da5f8c7898777b19bf

  • SHA1

    bb5ff994557b15a41bef1ecf1c0a1f61197e8599

  • SHA256

    7cdb5caa02641106bcff05aac76786d387a168624e34e47b3a39ec5d054fcfe0

  • SHA512

    aef932da27b6a3d920ad381c4add299c047a7e5f0c4d27204e475b03a8eecef64a3265827a5b4acaf2df7e5e7386b4bd69ef933a0c090922cbefd93fd617ea1d

  • SSDEEP

    12288:xmhgSTvlmI8jJ0dYCng1djBQIU5NIT1AJYfRDRCT3BqIgJ:xmhgSTNC90dYZ1djBQc1dCLBqIgJ

  Score

  10^/10

  redlinesectopratlocal host: pcagilenetinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2