Extracted

• • Target

    2025-03-12_21536c470fe15ffb271f09a730cef39a_agent-tesla_hiddentear

  • Size

    583KB

  • MD5

    21536c470fe15ffb271f09a730cef39a

  • SHA1

    534c0188bb44a6a63a25c226de1c3d7d3e8c42be

  • SHA256

    68a23a92e5e7d02bc1b19df9a41b199965e45c9e82a9921f773ac0fbd43712c7

  • SHA512

    24ca460dc96f1b71096dc83e9091257da3d71c7714879d680c42e4f1e7a494d394c31ad2244cbd1c647260309bbff1d3e540a81f48b9ba58cab95f30a54db3f5

  • SSDEEP

    12288:SfEW5TFXH2K6vwu/R++0fXN+6PGpyV3nUrseCp9YPff06odAA:NWf2HYuZ1gd+w3E3Cp9gfiA

  Score

  10^/10

  discoveryexecutionredlinesectopratcheatinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2