Extracted

• • Target
    bea2c74394f61644907cb9dc8915a94fe60de40adc1e1602ba96920ee6f36f68.exe
  • Size 653KB
  • SHA256 bea2c74394f61644907cb9dc8915a94fe60de40adc1e1602ba96920ee6f36f68
  • MD5 c906e130f32aeda6465bcbbf4b69899d
  • SHA1 a8607b943d422545c3e2242842b9a31a9edc6683
  • SHA512 be921d26bd76b3b17ee7d588de3344ab60a58b4666123d5aa689fdddbc52e6792453c707fd77b00c3cd0eecf5c52dcc2c3971cda04f9fcd23b9a763c76efc4a9
  • SSDEEP 12288:0thptc5i07QD0cJLdMdjcS9mXLCP7x1oQ4uy5GASYfVsFlMWTMdAA:EjRducS9wLo9+Q3MOpWWTWA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cheatdiscoveryexecutionredlinesectopratinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2