Extracted

• • Target
    8b904606790976539fd73805d8a8283a30b67907bc35f7e98e3f679d500d0aca.exe
  • Size 1.8MB
  • SHA256 8b904606790976539fd73805d8a8283a30b67907bc35f7e98e3f679d500d0aca
  • MD5 ee91506ae8f5516e3db1a0931ea8843c
  • SHA1 6862064d8a664626fd6d39e4d4c57d6c68ac245d
  • SHA512 d8bd0818dcdcf3904fb93af282c27f25607d980a5de18a4ff4081ecab43eee42408ba381e33531bdc5c261875b4076c214244c34d765cb0cd3f3351542cc1ae9
  • SSDEEP 24576:SR+kTF4nMlM6O7PxpXkEX7L1Mfyx4AdGIBDA2d7/cqPfRtItNaFIJ0AwJyxWgZqe:++uKnzZVkS10AdGI9lvRt8PxWYskAD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratultimatecrackpackcredential_accessdiscoveryexecutioninfostealerpersistenceratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2