Extracted

Extracted

• • Target

    SecuriteInfo.com.Trojan.Siggen19.32881.11458.27179.exe

  • Size

    1.5MB

  • MD5

    db361206702d61f0beff5f87508152e5

  • SHA1

    88e52c01ac24fc062221841948700c482090b145

  • SHA256

    333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1

  • SHA512

    3e6d49fbddaf6b005aa087c1345ddd156c43ae0b77f2eed4bc6d120b74ef3157414728066246ba8fa92e715abbb0a8e0704e2bf29fba4249454530ae8de80c74

  • SSDEEP

    24576:Bj8PZOWNKI9g7XEJ859lSYbd0OW5FwBy47rKDBhU6OC2nfLyf7MBTPanM:BEQWlm685KGd0Ogwj7WDk6zOba

  Score

  10^/10

  asyncratredlinetpb-grenninfostealerpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2