Extracted

• • Target
    96AD06B20362F378E5F81EDF6DD968EF.exe
  • Size 505KB
  • SHA256 89f3819c63fe7079db92866643e3f2e3b1a04c653c04411b630c72b8082c35b6
  • MD5 96ad06b20362f378e5f81edf6dd968ef
  • SHA1 7feb5233a0c1a1a9224cdbb8cf03d62cd99cf32a
  • SHA512 424eaa80d9facfd203ba1ecd7fd85dc2d03373fc1293ffa2fee914e4bf2ef68ba08dcd8ec913ad7c2cbd13dbd00542216e6b4fa8d07aa253f4fbeccce0e19932
  • SSDEEP 12288:eXbcmn/22sMbf0poapqLDzXAYwAg2OXgkR:jmnOGMXWDzX4Ag2OXH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2