Extracted

• • Target
    cfd967c789c68c41807d2d1424a7b3ba67d94834189750dc7b28da7513c4d0a5
  • Size 512KB
  • SHA256 cfd967c789c68c41807d2d1424a7b3ba67d94834189750dc7b28da7513c4d0a5
  • MD5 438a600526521cbaf9727a2c6bf41eba
  • SHA1 53b045ebc10a272380b0b48f8f7a3a96d2afd0b9
  • SHA512 118f2fe8636cf003c4eda3c3662d97bef1807d257d4d96f7ce167f350689f73d4651e9d5571da655bc2768ed0c4d1677eab183e5dcab935fe856208f0451ba49
  • SSDEEP 12288:BDf4QK88rOmq8aEcW/3z4DZInH0P7x+DoJ:BcQKNOtPvD7F+C
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2