Extracted

• • Target
    x286459ec629220bf6b92a8904bcf2efb7bbd70426c45663baad41a4d87b40532.exe
  • Size 998KB
  • SHA256 286459ec629220bf6b92a8904bcf2efb7bbd70426c45663baad41a4d87b40532
  • MD5 d23590ab10a5e9de107a1fef0d151d6e
  • SHA1 cc073038edc55fcc32025239c7c7c119295be926
  • SHA512 971ffbe20ab8245ce68fb1d476cf169c8d14311c794fa1bc905b7d82e7dad5f47bcf5ddc0e0575c124616ad47408be5609a83e6f05acbe1d3a404d3053013d06
  • SSDEEP 24576:3mqegcvW8L6fSHRRxwDh7F1xzh0NmxCjzD2qodRcbXmybH:3Cgcvj6f4Lw17F1xzWUS21dwXXbH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cheatdiscoveryexecutionredlinesectopratinfostealerpersistencerattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2