Extracted

• • Target

    D666C758BE2A66A4C8E0D3C089EA75B1.exe

  • Size

    634KB

  • MD5

    d666c758be2a66a4c8e0d3c089ea75b1

  • SHA1

    9ef031c211fb82b0810a45256ca9ad32f1577ad5

  • SHA256

    9fd0ede72e03f6a4897daaa809a4dafa9b9e0eeac52c5244b11df40e9a4af2f2

  • SHA512

    56931556326f41f360b31658ec4fb92104bc7610923429175d71e96e87258e22a574229fedc4262df52d33e631062a0710385131834399041d8ca9c89bf91f37

  • SSDEEP

    12288:B89WXV7O3SdeYogO832DYJTX6Y8RJ8y/59ifSA1Bd/:ZOi4b83tf8RtB9i62BF

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2