Extracted

• • Target
    8b2464dc6ca4d985648a9f789189f231
  • Size 3.2MB
  • SHA256 007c895f9b557ac4c9e269d7eecbd18cfadb6da52af796eb974a6d9b460acd43
  • MD5 8b2464dc6ca4d985648a9f789189f231
  • SHA1 40a0142bb8adf998b40633dfe9cb3c54f86f2034
  • SHA512 9e5e1edf11f71436273dc5fea2825122185e1ce64f41664327963060b5b4444dff5b2407c7e8c5e9797b5d023a43e25e77b42b1fe8761f7e02caa20cb44edf71
  • SSDEEP 49152:KYMh56AU8FNgba8wG39+T4jO7zwiCr5t8FNio/cuEzpINJP5qfhsg8Zr:Kth56AU0P8wG39xPiCNt8f/JPQ5sVZr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectoprat@lerasapogevasioninfostealerratthemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2