Extracted

• • Target

    357b2371c981675051594d5851dc7ca8.exe

  • Size

    535KB

  • MD5

    357b2371c981675051594d5851dc7ca8

  • SHA1

    f2e766123692f906b589e9a63059ec938e6c81f6

  • SHA256

    91146fa003f23bd4dae8f201f8941d7adc54474bd3215f6b4d3f9a783abc6805

  • SHA512

    f6bb07430716f87a8ed0278b8dfabaa696c16d54e66b874c02809c15777d722f09d19702f27c3cc3c604b85aaac4f78ec42e212ac8ff9171630c2fb33d379603

  • SSDEEP

    12288:uY5Q6QcCTSY+aZrwrxvNs+3pneL7wET6sRf9hovCSHvtW:UT/4rHsAO7wO6OjovFg

  Score

  10^/10

  redlinesectopratcheatcredential_accessdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2