Extracted

• • Target

    ec853dd1624cc25d5d80bd8f0d5596904492c7782ab8a2814393cf4fae01b0c2N.exe

  • Size

    696KB

  • MD5

    386f5153971c0c93a5cc465dbe30c860

  • SHA1

    3ebd0c0b5b67e8e4c699a992c1372027ae74df28

  • SHA256

    ec853dd1624cc25d5d80bd8f0d5596904492c7782ab8a2814393cf4fae01b0c2

  • SHA512

    8ee38e90cfb3dd74eafd77ff8bdf923dbf570f36cbdf712e6212dc360811bdc801251c1b52595481fc06db8d5a38828c68956817836c091c2201bc9f7f5356f6

  • SSDEEP

    12288:7kM5KbJvJmZeyjABLpQzhC838e2ugLl4ivw7gpIjw0wy9EXX+uB:DcJmYcABLuzhCsVkuew7gYw0wFOuB

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2