Extracted

• • Target

    a977a5b1cda46d79bdd0f4c24ec6433e89bbe1ee800d48c4f3c23ecb38593bb9N

  • Size

    732KB

  • MD5

    9b5c455bc6d2985d41cab7bc6a36cc80

  • SHA1

    187b73f9d3d3e7af3b40978043543ed682f466e6

  • SHA256

    a977a5b1cda46d79bdd0f4c24ec6433e89bbe1ee800d48c4f3c23ecb38593bb9

  • SHA512

    51ac5ec377bd41ea829f5f764f9dfb50620590fcea7e41fb2db2a68b4d4e154380a6e2b479ad427251bea1c37319299cd5765d4d93072cb9651bf44bd497865d

  • SSDEEP

    12288:U08rd/YUPOEBPSE3fahRxFkElhiYigISJ1MLh/9/i3MNi0f:SPPx3fahbFkEriYvISfM3i3Qic

  Score

  10^/10

  redlinesectopratsuccess-logsdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2