Extracted

• • Target

    HEEX-SO010483.exe

  • Size

    594KB

  • MD5

    39c7a9eb89bfd37f75b680390e556709

  • SHA1

    a05349b8760937693077cff5887444e1b20b6b19

  • SHA256

    c96a4929bbf67a9c4dca1da11d932a3ff8a4e0702933aa30c3835559f6771d0c

  • SHA512

    11394ab6dd63e2ecf68c407fb93a820aa926c7ca76812f68a8d0a3984297e41f91408192f86e67f3990005e251c13d67fff9046579ed0b6a30d28f0dc9109f85

  • SSDEEP

    12288:gXbZRm+GBCij769yptQkM2V4LNS8bMNKV0t76ih/:cbZRmjdVCj2MSbNKEx

  Score

  10^/10

  redlinesectopratclientdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2