Extracted

• • Target
    2025-08-07_be5762ae32217150a20c2f8a6acc3cc0_agent-tesla_elex_formbook_hiddentear_loki-bot_remcos_xloader
  • Size 618KB
  • SHA256 7121d228c3915be26afab3de35bd0af002210d1a5db9705d35d231967c71091b
  • MD5 be5762ae32217150a20c2f8a6acc3cc0
  • SHA1 1abb86eabc594aba3c306b93de2803769e1674e5
  • SHA512 d809f402836f2a833837f9fbfbd9419a9f3cf622688e9f9284a17ec320c89bb8a21e6b2ede7c23f11e6a6808e8c305ad8f1ad3848b9051c3661960db64896326
  • SSDEEP 12288:T3NN+H6k3lfrjtzhxKm6aSGyYicqVlXYGgYSxuBJ7sDEdAA:DNAJkOJipVlXYZVmOiA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratcheatdiscoveryexecutioninfostealerratspywaretrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1