General
- Target 5c95d5493dda877b228a6485a6d40d9c.exe
- Size 7.3MB
- Sample240525-3bd9vaeh38
- SHA256 fdb5b2a0041b0939552ecd31e382e28529313c8bc8a656eb7de1cef9fbd6eee9
Score
10/10
Malware Config
Targets
-
- Target 5c95d5493dda877b228a6485a6d40d9c.exe
- Size 7.3MB
- SHA256 fdb5b2a0041b0939552ecd31e382e28529313c8bc8a656eb7de1cef9fbd6eee9
Score10/10RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Themida packer
Detects Themida, an advanced Windows software protection system.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Suspicious use of NtSetInformationThreadHideFromDebugger