Extracted

• • Target

    557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe

  • Size

    534KB

  • MD5

    c3fdf39d2d65a017f26078457440e032

  • SHA1

    fc0aa0a24f6aaf76a95ae7c42d248db182da70ae

  • SHA256

    557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5

  • SHA512

    3d6930cb8267ebeb77d6cc44b593d091a649fa0abd3fb694746c7c19b42c80140730a84a8eadefa15df7586c9464a20fda582b37c1f41f237affe8804077e5c8

  • SSDEEP

    12288:z5mZN9d8Nf+wYA9BLhV9uWLiPgdfkxIexYHEaE+og:c96VH1VOPEkuEarf

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2