Extracted

• • Target

    cbf26eb04d7e44410aff2c8768f380ff4c2c83bd98d338d53dbe0d8ec6aeb635.exe

  • Size

    910KB

  • MD5

    393e9ff21a92891703cf37da4af305f3

  • SHA1

    4f2f1dd986988ba60d31f95b2cd0a4a9c5a700b7

  • SHA256

    cbf26eb04d7e44410aff2c8768f380ff4c2c83bd98d338d53dbe0d8ec6aeb635

  • SHA512

    089c37b3405894ed38e73dda352ce95e86f56b72f0454ab60835be87d79473009af121625758d5e8733963575afc50425cf1a1739bd3058aa165290566133c0e

  • SSDEEP

    24576:hBqNnb4XlUfMDsZGcZYJHTmMAvRVXI7tHIRRu:hYnbuyEDsZ7ZYNCMAvRWtHEI

  Score

  10^/10

  redlinesectopratcheatexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2