Extracted

• • Target

    2024-12-10_e2d52a4ec25873e02c7456353d4bc8a5_formbook_hiddentear

  • Size

    618KB

  • MD5

    e2d52a4ec25873e02c7456353d4bc8a5

  • SHA1

    23819b1aad03c01afea7cc31fca230d7e929c96e

  • SHA256

    2d979f5b8095c434260084a058d8c1ae25f3bef0953bbd458a6f7deb84ed138f

  • SHA512

    f80ad169c4ae0d53ff365c1eb754ff543515acdf8f55f1a8101724904ed81917b161792693348f8db683b64a34b188747cf3def2e8c9a78b5a7159d86af6fcdf

  • SSDEEP

    12288:sPG7rdWCDXNfLaJP/dQH1X0RiNQQ8xZoYC+jdAA:/JWIXtkQV0RiyoiA

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2