Extracted

• • Target

    2025-03-18_7613975c38818b3e713fcc952008022d_agent-tesla_hiddentear_xloader

  • Size

    683KB

  • MD5

    7613975c38818b3e713fcc952008022d

  • SHA1

    c2bc285e977ad4321005c922fe5b839ece0f9ff7

  • SHA256

    15b537f30441cecdf80a786745e07325182b608bf25ce31c8b385f38f4998c8a

  • SHA512

    195248a6a1918cd7d76edba3cb94e8fa9c972c3f8035778da1dbe7d9c893126fe66c77039e281f3a7598758558e1a5cbed73076271f869ee78799ea3b0c81235

  • SSDEEP

    12288:AQELOiPyAuxP18MbaKsorV3KRgjfN6FD12J+jg8U2dAA:XiP8jaIIufNUp2gCEA

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2