Extracted

• • Target

    a297934eebf55760d84b4b5343c91280991aa59c87a48fd9866211f11542852e.exe

  • Size

    696KB

  • MD5

    e29978e48feda663a48710a66357cb91

  • SHA1

    ee3be08a0932b74891dd0b9fdaf1ad207caac12d

  • SHA256

    a297934eebf55760d84b4b5343c91280991aa59c87a48fd9866211f11542852e

  • SHA512

    14eed510477700839df24f4677413a02dbf3a8ae99a34e55cac42aae4a97e3d676fb9fecefe3b0401d606b90f56958bb4bd3c8a30dd712515cd86143ddf055fc

  • SSDEEP

    12288:7kM5KbJvJmZeyjABLpQzhC838e2ugLl4ivw7gpIjw0wy9EXX+uBV:DcJmYcABLuzhCsVkuew7gYw0wFOuBV

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2