Extracted

• • Target
    8e2489bf65b43f711ac1f01752872418
  • Size 2.3MB
  • SHA256 9e8b0260c4d5d666efd599946b2d6377a34d1e670f51408a88a7fe95c4c960c4
  • MD5 8e2489bf65b43f711ac1f01752872418
  • SHA1 7ba722bbbf13f1eb7d3be8216d6e01f7a78d670c
  • SHA512 53173ee0ba6fc46dd5e2c67267a2a3ad64869e2caec24b2aaaa75b0fc37e8d0eb680d8dac281bee27654a1ab11a0bc25459ec534cc8c45bf9cad3a5d50009783
  • SSDEEP 49152:q5+hFGkqb3KQPiCRFpIfp/au9InDnUQtP+0n/hbxiz8lVHTIioOFZQ+A:q5aFGT6cDRPIhajnD5PppbxiqZ7A
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectoprat@janhidfinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2