Extracted

• • Target

    jli.dll

  • Size

    1.8MB

  • MD5

    072b9390df5cbe5015fe58da16923659

  • SHA1

    bea24458f5b981924f21c16cf8ac77566a821d65

  • SHA256

    fd2144a39e567bdf97b54014c6d912289bbd055835190fe377236c3ff8f89290

  • SHA512

    e84d607b0f1d039e371c7462f332193e6d0a41bcd3b50810ac162e5375b88d27f9d940d003ee2cfea11b5d66dfb33fc4b74fa50148749a96102b33bac90cca64

  • SSDEEP

    24576:3x9Cm6pOSgrbtR/UDI2KNc32ybHAaD835rkbqO1UkTrcwCPIdkgVmdwALoBhkw2:3x9Cm6ASgrbtFUDXTA7gMlPIxYRLgGr

  Score

  10^/10

  redlinesectopratlovatocredential_accessdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1