Extracted

• • Target

    f6b09208c3523be3a490af2fc305d4574b38d95a435c8a55402fca38597e6dac

  • Size

    647KB

  • MD5

    68b2a6e71c0c904a9aeabfc9adbf7a21

  • SHA1

    0577bcb0a9736b45f1eb92f6070aac2134e674dc

  • SHA256

    f6b09208c3523be3a490af2fc305d4574b38d95a435c8a55402fca38597e6dac

  • SHA512

    077b52bf789dca81f8155182eae1fa8ce529586f70a2cb8ce7298917fb6f42c83dcb1cb9274e498295bdda65d4d2d7dd41ef6ea086dfb510ef75c871fb8daf46

  • SSDEEP

    12288:Q+KncNPCdkjtqD56vpunMKgabsvmyArpBAz9TjcQ1AQw9xkR:0mPCdkpqF6vpjmsenVBA1jd1AT+

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2