Extracted

• • Target

    03dba2efb9ae3e04b86a4767f8c80b8f54dc8450e57db279a3f5ace51522aeee

  • Size

    1.7MB

  • MD5

    b9267f339dc13c70de5c5c0b730556c7

  • SHA1

    2f0d338e011e66e1e23face8078cacbfe36a7893

  • SHA256

    03dba2efb9ae3e04b86a4767f8c80b8f54dc8450e57db279a3f5ace51522aeee

  • SHA512

    74310636ee065c9b7c143903352cb8f7590c71a16fcef8d4d2d5c5786053e518f28b43dbe9d66c45ae61062a4c4351311096dc0fd7a0be9a2f7d4e4ac79ab046

  • SSDEEP

    49152:Jff6BM8k0KxhnIwvkBAKYWvP0iZ2q3nze6:lm0VIwvkPYW0clK6

  Score

  10^/10

  redlinesectopratcheatdefense_evasiondiscoveryinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2