Extracted

• • Target

    4d970a2e52b9b8211c64097581942527

  • Size

    1.1MB

  • MD5

    4d970a2e52b9b8211c64097581942527

  • SHA1

    23db90c824e77ea619c3f771c75d919c703e9735

  • SHA256

    76cde08b521a97baf4aebab068d5c41fa03821dc4c4170a791ebbdcb6a26de64

  • SHA512

    3093e9824212177d699c7088c660882ef86fc34d21cc6f91d13059a41fdd7a05635f4b826016646959b620da5b28dd74903296078036f1f31ff0960c0f7429ee

  • SSDEEP

    24576:SdW6C292GDnK/p61BLUEuG7W7Mmw87WVQ9Yaek4QpWMLMG:SdW6CLcK/w1Zr7uLpWa9Yq9gk

  Score

  10^/10

  redlinesectopratkakaakakakakinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2