Extracted

• • Target

    352f063acb0881329456d7aaee89b070N.exe

  • Size

    508KB

  • MD5

    352f063acb0881329456d7aaee89b070

  • SHA1

    e9f97c915402a80ac2a90562c8c75036758deae6

  • SHA256

    7a71c60c503064ec746f66922bdab12fe8738dfd82fcb3447650e45aba762bb1

  • SHA512

    b18ff2af41e18bdf0ad707ba6f9fcf6bfc5497c08352c2bf2ae31ebfacb49340597c54f840cf9a2013f722d096b53e88db20493c64a4e6bdec62de2892cf037c

  • SSDEEP

    12288:7orlAypL9evu2iBzT2R5ijuOzQz6Y0H2md5cP8f6:AAypERyv25OzQz7md5cX

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2