Extracted

• • Target

    GenValObj.exe

  • Size

    2.2MB

  • MD5

    d2b4448a53561596c82abc5b8a72b385

  • SHA1

    62a552abd96e5320b393fbeb47e5bd61722181e0

  • SHA256

    b2c9897574e420f2cbe55f480862abf607da31b34fc3173129e2fb3c0e402838

  • SHA512

    15749fc8bc10f58d205ff8b08db93f07780de7476e2d1cf1984815a3857a02a095c189007350760261c93dd7f524c9f46c363b49838ff478ce40aaed95c60a9a

  • SSDEEP

    24576:Ov0rlgUsLawUxQ0JXfBpGDtflgyA0CbbuCZPUbEHHYuMLON/pj3GRyW4lO:O

  Score

  10^/10

  discoveryredlinesectopratinstall_bot6infostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3