Extracted

• • Target
    44ba13a119d19891a586d95310d8a51e9440fe2c1659b397d5795ecab37e3eeb.exe
  • Size 794KB
  • SHA256 44ba13a119d19891a586d95310d8a51e9440fe2c1659b397d5795ecab37e3eeb
  • MD5 3275b7e131f4fa647860ab05d943df6a
  • SHA1 b71625ac8fc87558dee875298018b450173ab2e8
  • SHA512 895f9cadae7efa4132f141d27d0c0eb622a121b24d6d50b250157c4827718263f5730c8eb15d97e6a8ee77f49a5b97c5b9db465719c39061a4c708374aa7ba98
  • SSDEEP 24576:TxLsMs8WdXk89WkrN93cjuOqNZtqffDKU4YRSFu:Bsld/9WkrnVOqPtqX+UH0g
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratcheatinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables packed with SmartAssembly

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2