Extracted

• • Target
    RFQ-SW M-0013091-DHABI EQUIPMENT.exe
  • Size 1.9MB
  • SHA256 fae7035785c175dcad0c51146ce8c55fbf0d9f09380c2a20a52b4bdc67205030
  • MD5 af951609aa80d5de83f9a02db46bd8cc
  • SHA1 cdac52bb244e70b48d3d414f451bb0b4de1c4f8e
  • SHA512 bcdf5c251155172f953955c534cee9cacf897bc1c71d78abbe36630b795d50041c65037413aee191e25d29c6a4d5d6bc8640669cbf83def15e368baf8ede3732
  • SSDEEP 12288:aUANuMn2d0FH5+fZMdgESJ7UP0+F1e9FMRr6A1:lANuMnNF8MevUPPF893A1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratlovatocredential_accessdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2