Extracted

Extracted

• • Target

    0x00080000000162ed-1051.dat

  • Size

    45KB

  • MD5

    3b86abe4c79286ed06965c268968c03d

  • SHA1

    64afe64ee719aa3526023a5f7edacd44db21bde4

  • SHA256

    47a46de105177d826cbda74051f7f9d7bb95ed079c2e636743f9f04ad8c6c4a7

  • SHA512

    68f108646437fd72622cd1f719b2092b095e67500502981c4b605c64acaa38c12f46a82e47318b405137e5112ff82ccb51bfbb953b67fd3d1e9a5de1c2874483

  • SSDEEP

    768:juAKNTR4ydbWUnrGJmo2q7zL5P02FUFdxYkk8PIWzjbAgX3ih8QNd4sqyVUbGKZ9:juAKNTRZ22oLDmWBW3bnXSh8QN6sqEWh

  Score

  10^/10

  asyncratredlinesectopratserver.underground-cheat.xyzdiscoveryexecutioninfostealerpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2