Extracted

• • Target

    40926831760f18cb9d9a3ab55c3a1192a957334cea6e29232525b030a1b3d6a8.exe

  • Size

    1.2MB

  • MD5

    852d2c5d88665b710d68e4ecd9181758

  • SHA1

    94f4a69f1778dd670e1955585c5593c949098bca

  • SHA256

    40926831760f18cb9d9a3ab55c3a1192a957334cea6e29232525b030a1b3d6a8

  • SHA512

    36dbc7021dc108ae982ff04963f678b7925679c6ae0fe689db8836c631c7132b4fbe4b241a161157e963c131a469dabac5c0d1f7267192e01fc3b711accf97bd

  • SSDEEP

    12288:unp+wJ9GeeYwTVlCOCQWAKeAaf/+YQZ7QQ6m1N4LWgViFd1kXanGJAWCG2GBKf/V:uOeZ7YymWgpkM4us

  Score

  10^/10

  redlinesectoprat@andrey_dolmatovdiscoveryinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2