Extracted

• • Target
    3DCF5E9D7DF3365E8C33641790B465CB.exe
  • Size 898KB
  • SHA256 8b052861fba7933b8963bc3fc428dd51b549f07c985fda693afe5ea2ac39cf3b
  • MD5 3dcf5e9d7df3365e8c33641790b465cb
  • SHA1 f52d62e150e49362e5112c187ba063f7408abe2f
  • SHA512 0a0c7159d423cf24cc21563ff2f0c752db10a8fc0cf52483b6d6c9f3a40d66739131ca24cd5e801c80410abd85358a33a207f1c3c8ab774d95b00bd8cf35db4a
  • SSDEEP 24576:HzHpguQDwTzegkDe6PPCmPK3JPpJPh++UvQdgdUgVictow:HzHmuj2gmtORLUvxFQc5
  • TLSH
    T1F3151230639ECE2AC4ED07B94871D33813F68D6EB112D3478EEA7DEB79967C24944612
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdiscoveryredlinesectopratinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2