Extracted

• • Target

    SAMPLES DRAWING & PICTURS.exe

  • Size

    520KB

  • MD5

    3e0b15798b6c27cb538668aad787cca8

  • SHA1

    35cbef46b336f9f063d4ad49ff98e10e346b2cba

  • SHA256

    f5d5b215b155bf76191567f503124575c35d80129aad17ead629674e6d618114

  • SHA512

    7782bb5fd6aa9e339fb208d1ad3fe90fec4a74201b86b4c93c29a86306b5c9699963e543e66bfb39b672b247e51a797ef1bf8d65cbdfc937064c383a2901d4fd

  • SSDEEP

    12288:3jLORFkieV5S+ErhY56Hf0f/tTj0w5IFn4TvtsfO0d1U:3vBDY1Hf0fFP0yUn4TvtsW07

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1