Extracted

• • Target

    b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe

  • Size

    551KB

  • MD5

    da6597ce526d7c6f8e97ed1a8d80d5ac

  • SHA1

    31f7e6632e21ffba5f0dd841823baef2aff8ffdd

  • SHA256

    b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721

  • SHA512

    63db4436eaeabac54ad54e9dd99742d6f7a8e2857807eab5a097ed75273b3298b133754e0eaed47854453c2bd1ba423d0d0f9be7e6691e28ab1888a947e4a1cf

  • SSDEEP

    12288:hhQbEeX/zYMIxKzS7no9YB6Hd5fZoyr+oqfk2AqkY:hh0//PIV7ob/oyr+oqT

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2