Extracted

• • Target

    44ba13a119d19891a586d95310d8a51e9440fe2c1659b397d5795ecab37e3eeb.exe

  • Size

    794KB

  • MD5

    3275b7e131f4fa647860ab05d943df6a

  • SHA1

    b71625ac8fc87558dee875298018b450173ab2e8

  • SHA256

    44ba13a119d19891a586d95310d8a51e9440fe2c1659b397d5795ecab37e3eeb

  • SHA512

    895f9cadae7efa4132f141d27d0c0eb622a121b24d6d50b250157c4827718263f5730c8eb15d97e6a8ee77f49a5b97c5b9db465719c39061a4c708374aa7ba98

  • SSDEEP

    24576:TxLsMs8WdXk89WkrN93cjuOqNZtqffDKU4YRSFu:Bsld/9WkrnVOqPtqX+UH0g

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2