Extracted

• • Target
    9027c7cdfa192c4b51b2fbfe172cb362
  • Size 2.5MB
  • SHA256 2dc08a4bac06bfd60a823ca42a24865aa6bd91cbc4b8c7af669d0c590f41c5d6
  • MD5 9027c7cdfa192c4b51b2fbfe172cb362
  • SHA1 c8ad210c347f6c1f83333a0a6d8787f393b9ce70
  • SHA512 2e38af46a1e28bb4d8de57c92952950b09716d85d6a829dd9d3f8ef671fc1d3e765e5576783cae886d185763ed319c5314281619f3c5747816af61cc88be0d59
  • SSDEEP 49152:s3dVNDEpSMWMXkIhV8tYDotWwCodF+fXYT5aPVouI6vOgdICG:sFEpJXkeVaio4Y6YT5tubvOH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratitachiinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2