Extracted

• • Target
    17bddddba2408e1df369a70eedbd0b5a7a14a075add95ff2f8bfd0ee3adca8d6.exe
  • Size 915KB
  • SHA256 17bddddba2408e1df369a70eedbd0b5a7a14a075add95ff2f8bfd0ee3adca8d6
  • MD5 f7988461991cc954ace2a4b169df17d9
  • SHA1 e032858575e890edb3e4d26c3acb1ebd1b0ca4f2
  • SHA512 e1e3d4d5475d45472519f2f0a11d0ea857fc950ce796357dd0c5c253bf831329de96765f9218c45d1539ad1a78551f3197ceb0e81cac9e9451dac3fbcb4572ab
  • SSDEEP 24576:9BqNnb4X5EWg6SX5kPkWwM/tZ9qHoz5gq4vtD:9Ynbu+Wg6SjYjp5UvJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratcheatinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables packed with SmartAssembly

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2