Extracted

• • Target
    2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_
  • Size 974KB
  • SHA256 b49d73fd66670362b72f74cbfe4816329b8c74bcb9c6a56a2e962d8afd2c6bad
  • MD5 4d3a87cb9325abf631c81ebb64ee162e
  • SHA1 1ff315eb4f2594781f038b8f05ff852b4e8171e3
  • SHA512 2f65b4616cce2eb50f198d6aad19646b7e579a95d50aa072726480d30042a8081436319f75a73711b572f3e84faa2db26e313b88589bd4189fe007cf23493656
  • SSDEEP 12288:RmTNh7sB/TVOv2JkVtNmnQIiImZJpRh0y9pxJs:RqNh7sB/TV5JkVtNmnQIi1h06f
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  alice2discoveryexecutionredlinesectopratinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2