Extracted

• • Target

    2025-03-18_88ec2ffed558e03c08483dce7beb31d8_agent-tesla_hiddentear_xloader

  • Size

    682KB

  • MD5

    88ec2ffed558e03c08483dce7beb31d8

  • SHA1

    9f8ece40eba8ddf2122f12058cb7aa4fc224b662

  • SHA256

    7576186f2485c61babf875637873233d923206b7f6c54eb84f8922b75a11c4e2

  • SHA512

    548ca2624f20924e1d775068f3cea99d86cfcf8452dcc7de1820748e00e482893eec334238ef3b2b687a11c992a64eb24f807ffcc7871ae936fbd1a755d60439

  • SSDEEP

    12288:OQ5iP85hwKfDZAsbxsxvU1NfCd1lFWxoEBl45qdAA:DiPMuwxBfCdYiEs+A

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2