Extracted

• • Target

    8d34cad6921facb89f0c0de64701f9b99c6473d7c850464401b481e5c72af30aN.exe

  • Size

    512KB

  • MD5

    ed11ba3d18046b73a0e7039cd9ffe8d0

  • SHA1

    69d1aaed07babb15c65db05a384ea1377258914a

  • SHA256

    8d34cad6921facb89f0c0de64701f9b99c6473d7c850464401b481e5c72af30a

  • SHA512

    bf2a57a3d60f645f6889d415331ec42b18db4ce34aa83f827a495f31e168be3930d494dcf9b9b9040e02c523e0ccb4f9c3b209c0efaf8912bf7b3d054a361ba8

  • SSDEEP

    12288:/60nsDoXKGlBcFJiIA6EgTS7GVmKLgxz+0HgB6wkR:NnrKGlB4iiEV7ULsDa63

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2