Extracted

• • Target

    234789947ece36321386c3decbeafd2933da462f41056a27b042db2c2fd8aea7.exe

  • Size

    1.1MB

  • MD5

    142727883c537e287bae329e5a2e0ce8

  • SHA1

    981eaaaba35b326a5dbe386cc5a02adeb52447e7

  • SHA256

    234789947ece36321386c3decbeafd2933da462f41056a27b042db2c2fd8aea7

  • SHA512

    e557519293c0518f5df61d77b42a1f2b4ee58c1bb33ae3db5b7c2da4754bf54f652e51f2e437b138fb62e6750b6caa2c882332ef9b86713f9c8a62566a821212

  • SSDEEP

    24576:1MOjO8wmd7hUjBGna1qIWFLISsSaYEbJgEK8LFYUs:1MOjO857CjJuLI1lyEfx

  Score

  10^/10

  discoveryredlinesectopratishopexecutioninfostealerratspywaretrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2