Extracted

• • Target
    da16ba068bb93502c3a3e524d4cfd041
  • Size 876KB
  • SHA256 501e91b9bac974282cf4fb0907c1b9c73f272cb1dd90554ecdaf02940bc6647a
  • MD5 da16ba068bb93502c3a3e524d4cfd041
  • SHA1 1314f1c194f21b1086e8520deffd657fde82e7a0
  • SHA512 ca6e2b92af65b8292efc0b5ac812c6c0efee2f23d3adc03c6a67beeda200ca377ac83b6dbf588e1548c23c90cdfe864c90a51782ecec594c129662c518995e36
  • SSDEEP 24576:nyLHuEU/Ve5SXJe8qXHgaKpr6gLUIpnK2ljS27vs:yLOgR3fgLPpyU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratbuild2_mastifagilenetinfostealerpersistencerattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2