Extracted

• • Target

    2024-11-22_f013c4e60673ec88cc3eb813a2907a13_hiddentear

  • Size

    677KB

  • MD5

    f013c4e60673ec88cc3eb813a2907a13

  • SHA1

    e32a9e5054bc76a63b86d245bac325540277b358

  • SHA256

    1002a3e30b6720bace101a0bba1f2861778432ed95a5d7cdc868f6c62b7f68e1

  • SHA512

    b439b9c1996b991cb21d88726f70f2c78289943c732c7e1d7dab7653f608b837711c88a330e1e1b2d52e967bc4199e6369007ffcb4648b70eedbc9584df15d72

  • SSDEEP

    12288:NrOU+Ri3AgFdsivU1xtw08bMoRQAqRv868iOZ4ok3LKdAA:WQ3AgsYUJtMMonG87iok3UA

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerratspywaretrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2