Extracted

• • Target

    f73b6a93d17c84ef2d94825b53da5f6c7e099693bd3ed909b642176c066afb7d.exe

  • Size

    522KB

  • MD5

    bf2584501c4e1706a020093d3fce2f4e

  • SHA1

    98039d35d4bcc6cfd9ea5edaa6439bdc565f7c15

  • SHA256

    f73b6a93d17c84ef2d94825b53da5f6c7e099693bd3ed909b642176c066afb7d

  • SHA512

    f93441103626b64b55ce854bdae1be40e854b10a80392cdfc208931bd49bedee0bf8f3071fb5b28fe56ea1b0d9518decf01bd233115c8a26ade0b6adc4b5a911

  • SSDEEP

    12288:IMyCpQuRWIPxTIeVJbZnjlz3W/9Fex4XmwRzbgTzzha+X:IMyCQuHzHx6/XeKXJy1X

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2