Extracted

• • Target

    update.exe

  • Size

    1.4MB

  • MD5

    b5b47184175f3b329e06238e6f55f7bf

  • SHA1

    20516898407496ef5b6079c0ca60b620da946526

  • SHA256

    c6d4a545c17d3c8e6d2fa0b9ef4d915ff7d025a5d4cdf5fa9000de4c2a5725f6

  • SHA512

    d31b6406ce05761027c02f1b8cd1b78e449aff797560ed68c68a9ac2945ce6f700baa4ed659e10cfe5c0bdada5aab838eba77e2411277fea7653f283a59df6e8

  • SSDEEP

    24576:3xJWx7zJo9IanLupW1nmUxOAD7RsiHNRj7BYPkHNB4U:hEx73HSnpoi7zNp9YPnU

  Score

  10^/10

  discoveryredlinesectopratusa_installsinfostealerratspywaretrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2