Extracted

• • Target
    8b1172d8f7f182a2da21c3b1920f0762
  • Size 2.3MB
  • SHA256 41e314c47a93b3d35dd35c3ba7c319f6da4c3da96e8b2055e332fe48b4121ca6
  • MD5 8b1172d8f7f182a2da21c3b1920f0762
  • SHA1 172668724285591accc5b1fec86f9fa92d08d9c8
  • SHA512 81ad4ebce6522cdbb86c9db0b239e359938abae8362ac4e1340dbae5ce122cd3b661fc4199a5eb6ba6e9ccac9c39c1ac3a87218a64ab995ccefe84798e8c6ecb
  • SSDEEP 49152:Q5+hFlS+Jb5MGOmvZS8nDgDEi1Gptbe2eoxiz8lVHTIioOFZQ+I:Q5aFljJdMdmvo8DgGrbe2eoxiqZ7I
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectoprat@t232hinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2