Extracted

• • Target

    8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N

  • Size

    551KB

  • MD5

    79062523679454d69c6d29f1e0e63010

  • SHA1

    d373902d5f33f96a63e4148196eed17bd77bd491

  • SHA256

    8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95

  • SHA512

    63321ec53b5b0d2c3bc45ef33e89e7d36bd49bc18db0e50715ceb04c1b7dda09ac072eb667ad3af759420499015b594e2f1e6f266d52ff6f5555bd9efade920e

  • SSDEEP

    12288:hhQbEeX/zYMIxKzS7no9YB6Hd5fZoyr+oqfk2AqkR:hh0//PIV7ob/oyr+oqu

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2