Extracted

• • Target
    NEW ORDER & SAMPLE Drawing.exe
  • Size 1.1MB
  • SHA256 343d2869af991090046a291b95e718be61e5b3f06246e4d5371fd0f7f8b62eeb
  • MD5 3203108afa7e068cc23e08372a4d0447
  • SHA1 46a541a6a8a184d0bfcb3fa55a69f4c6840308c4
  • SHA512 4ce5ff6df8c4c028b55f69ae4cca3eea6d26e89e8ecffc6e3baf22ada0af090e67d5f0e9725c2dc3399ad67621016cef145468fbbe1b45d6b3a37c342e4fefe6
  • SSDEEP 24576:rguQH6V8BTMPgWf79tfKBWUebh9Qix5Qg+50pdqiVict:0ujC1+gq9tfKB7eb3QuQg+updqiQc
  • TLSH
    T1AD352358369DCE03C47917F10572C33817B09E6B6023E36B8EEE6DEBB9A6B425459343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdiscoveryredlinesectopratinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2