Extracted

• • Target

    3599fa63d78413242a88966d3b4b14ef.exe

  • Size

    713KB

  • MD5

    3599fa63d78413242a88966d3b4b14ef

  • SHA1

    44526b00e847d9a16908c79f72dab1af4a2edf29

  • SHA256

    c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33

  • SHA512

    e04604e58c9a0eb4e6bbea99d59295463cb9058f82c2527502acb6fe47989fc4f72b69338bb66ca5c5fc5a62d785fb65fcd4eb272a6136a1c240592076845d73

  • SSDEEP

    12288:vV9E8GILjWLWg/yvjaRBv5MIorus1IPI4AMqoYg/6vXdW1JeSel43qiukR:7cam5MI+TIPuM//CXd+JWl46i1

  Score

  10^/10

  redlinesectopratcheatexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2