Extracted

• • Target

    014b2ca1f9e6ad821c1a384b9d384f31.exe

  • Size

    998KB

  • MD5

    014b2ca1f9e6ad821c1a384b9d384f31

  • SHA1

    fca0ae3b21d561c530c5a52af19150100b2e0a6c

  • SHA256

    72ef04b633c90ce77442104498f7b667e6bcf0deee9c837beb54d8d3bb3503e0

  • SHA512

    26cc6baa0654d7294df5a25f67d36d66ac7f918de9e3b92476170182ba64d9a5194a710aff90b642f0c0c7d8b1f9e0030814014f1372c85016bbcfeb18d97dfe

  • SSDEEP

    12288:v6jb6G5xtiI95yS+c57boNna6xg20t4ham0gX:v05xt9E3nakiW

  Score

  10^/10

  redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2