Extracted

• • Target
    4d598bafdcea52627cc45652e78ba810026ecbcc63a36d026733ee4ff3daf4d0.exe
  • Size 784KB
  • SHA256 4d598bafdcea52627cc45652e78ba810026ecbcc63a36d026733ee4ff3daf4d0
  • MD5 00ceed403228d22340cde79ca56a0f8d
  • SHA1 fab0ceeef3d1d315fe9556ae0d7f15c472e1e1ac
  • SHA512 66e3882ca906c24c4c886964abdd957834df0a6ca1210c77dbaf724844a67381fc9fc0a568c14c4abd2f1eec2e65c6e02e81249758eca9776ede28874acab025
  • SSDEEP 24576:3e3bSrN5f1P7oPiTjD4hZHZwrpGwUZbX:3ob0NjM+4hHwA5b
  • TLSH
    T1BB05121963ACC902D1B62FF41870E0B427B85DADD924CA821FCA7FEFB8797115684397
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdiscoveryredlinesectopratinfostealerrattrojanadwarepersistenceransomwarespyware

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • RedLine payload

  • SectopRAT payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2