Extracted

• • Target
    D666C758BE2A66A4C8E0D3C089EA75B1.exe
  • Size 634KB
  • SHA256 9fd0ede72e03f6a4897daaa809a4dafa9b9e0eeac52c5244b11df40e9a4af2f2
  • MD5 d666c758be2a66a4c8e0d3c089ea75b1
  • SHA1 9ef031c211fb82b0810a45256ca9ad32f1577ad5
  • SHA512 56931556326f41f360b31658ec4fb92104bc7610923429175d71e96e87258e22a574229fedc4262df52d33e631062a0710385131834399041d8ca9c89bf91f37
  • SSDEEP 12288:B89WXV7O3SdeYogO832DYJTX6Y8RJ8y/59ifSA1Bd/:ZOi4b83tf8RtB9i62BF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2