Extracted

• • Target
    2025-07-18_b786ff3c4040974c544156d8e5bbbcf0_agent-tesla_elex_hiddentear_loki-bot_remcos
  • Size 629KB
  • SHA256 35c8388a3b8fb7c09ee5786f1bdcfef5a30f04563624dce11d8a2b943bf3a614
  • MD5 b786ff3c4040974c544156d8e5bbbcf0
  • SHA1 dacfc30299935dd3f3827d3e98524fa1195d50f7
  • SHA512 8003afa6c2c39a807dea3e805071d5a8155d6610c80f1cd318ceb0b800f069dd7a844306c4f46d6c4e350d97b3768431baccb75c0e62c325b25a52a23b2023af
  • SSDEEP 12288:DbHfLPHe//qaIa2oNUkWGerRDj4pxRSCTInZHxTgdAA:DLfjHe//qaB3Y/t4pHS1px2A
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerratspywaretrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2