Extracted

• • Target
    9a73d70d350fabb83da0b6492a44f300
  • Size 2.3MB
  • SHA256 d2502a1553d0149e46dd657222d34bb88320de8c757d7c59d934a3c60699bea8
  • MD5 9a73d70d350fabb83da0b6492a44f300
  • SHA1 f46871ee0416f6586ae4e350fc08b699c4bb7224
  • SHA512 8ab9cff89776dd91ade43e6d9c6d886cbf0ea5d4faa79ba2be1c0b6e4b443013725f578cc55b63d4e0d75366d3317b3964ad16fd7589283a4dbc6c1514dd3f47
  • SSDEEP 49152:aNYkC24+agb3A2FUG7EVJGaLU4notKFExiz8lVHTIioOFZQ+M:aNkdTJGLt4ExiqZ7M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectoprat@yosiphyinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2