Extracted

Extracted

• • Target
    file.exe
  • Size 1.6MB
  • SHA256 6bf81a58f47093727e85a5175d3b7042384159ce7088fa94b4476bda09ea401e
  • MD5 21eb9600a3a6f166fec7f0ad6075318e
  • SHA1 e808587a3ab86b0c8954d473dc5c94d440439a6f
  • SHA512 f01b11de0d7bfa0bd97476de3757c2ae44270dc8747601360a27889769d99665e128c63ca798f413b3f47b697db987d9debe03a5566de88d35898dda6a8bde6e
  • SSDEEP 24576:YO5nKChjGa7Dck7K8O/5vJBeyy0WI8NM1xQZeXgrorB2qF:YmKSGWDB7aBZvYe1k3rorB2q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cheatdiscoveryexecutionredlinesectopratxworminfostealerratspywarestealertrojan

  • Detect Xworm Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2