Extracted

• • Target

    de1565a5b502c4e2ddf7dbeed2cc4ef685adb6f0731c386943ee6daee4c4fd85.exe

  • Size

    795KB

  • MD5

    76a8dd96ad6d6a1f4c1e58fa5781b5ea

  • SHA1

    320a0c397b4165ea4ff449a1cab48a246022c103

  • SHA256

    de1565a5b502c4e2ddf7dbeed2cc4ef685adb6f0731c386943ee6daee4c4fd85

  • SHA512

    16ec6c93ecf63cfa50ed155ef3b1ccd67b26f76f7884a15648d47745fc495a8dee7e79522d0a051724e36b5dfa879a9c1d9d6bd00f5792cb960a7a2d3879678d

  • SSDEEP

    12288:5X4riL9sU/BYuCQHip+hDa/fRRCcDt19QGHPgBWw/FPOl9H8s41UgHsOBAKRg3l:5XB5vC2ipMDGRRbggwNG9C1UgHs2pkl

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2