Extracted

• • Target

    1520-1517-0x00000000002A0000-0x0000000000718000-memory.dmp

  • Size

    4.2MB

  • MD5

    725028788b4ddb94037627616dc679c9

  • SHA1

    18f55a3e8e5d6dcc9fa8f5a7337b538e5033551c

  • SHA256

    e167f7a026f2a46fb5fbfe9147e528c8165d2d96fb4cc31d9c630574aba6740b

  • SHA512

    f272c4e20522db008bd3f3b43c02e1ad138b8092b01688710167a0982eaf0274b6678a8a981852b4aa3ce11a05d3d2696c8647be34450e27122efb2ec9029c28

  • SSDEEP

    49152:JRrBR6Yu++HK2HZ2BC3yPv4V6tUZJPqyhWzXRU6l3rIDUmGhgsca:JRNR6Yu+gHZBiPv4V7FFIlcDUBa/a

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Downloads MZ/PE file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2