Extracted

• • Target

    e974e7654f266f3ffd528d9d5e86deef33670aa08211272c5bb9085726789538.exe

  • Size

    717KB

  • MD5

    27c4201a3bb19251d3cde1d25c3bb63c

  • SHA1

    2154c05f8cd8dca7cbfff78ddf034770d29584dc

  • SHA256

    e974e7654f266f3ffd528d9d5e86deef33670aa08211272c5bb9085726789538

  • SHA512

    d9d084459135c8ced4ed6cff4bb4c140bb53fd6ecbe109c2657991a62a0fbd75d8fc2f829d39b5b68356164a8811f115a45c6c62ff3cca19e6f50e25cb5f8604

  • SSDEEP

    12288:L/ahzqGIoQl1RrN4wsT88ZLdIpT4bKzZrqr0:uOhGwM5b4Ju0

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2