Extracted

• • Target
    8aa9ab2243790b71e5df6d8cc14ab6f1
  • Size 493KB
  • SHA256 fae571fb96c0473f852e410c5d8f7d3ae06e9a2b6288afc2199c214ff8b1b39e
  • MD5 8aa9ab2243790b71e5df6d8cc14ab6f1
  • SHA1 54dd993db5d183244629e57cff921beacf4b19cc
  • SHA512 a5bd39344311ba5bfdb715f348b549ec5df59ac94a6cc505a3d3ca5662c70798afd06e81f7ccaa6da4b7135ff1097d74dc4600b658f3cfcc0adf8bb4e36b5298
  • SSDEEP 12288:rNpszYhvXWSVJdMae9X7wRJ4PaSUwuhB7UxfFoDJfqJ:JhvJVJdMV7wAPaNmf5J
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectoprat@vertebrae7infostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2