Extracted

• • Target

    9e24a45fbd62acc58bd0355ddf4c92f6fc7bddd7f82dbc81a744658b7c12b578

  • Size

    520KB

  • MD5

    a11581530fe0ee83ad07321f367b80f9

  • SHA1

    4efbefada5b2245701d5df47980d6012ec320a94

  • SHA256

    9e24a45fbd62acc58bd0355ddf4c92f6fc7bddd7f82dbc81a744658b7c12b578

  • SHA512

    569260b589a0b4bf24eff4d1db75a8bd1b3891844057104238c6c117c3a5191754e397c42faa785df3c00d6811bbd6cc52ff1ac86cdf973000a59fad1c4aad9a

  • SSDEEP

    12288:0Yo7tqBC6U3hHi9LTDKvc9ru8CZS1fVPHxUhr:po7tqhMdeLtOZS19/x0

  Score

  10^/10

  redlinesectoprathycediscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2