Extracted

• • Target
    8b052861fba7933b8963bc3fc428dd51b549f07c985fda693afe5ea2ac39cf3b.exe
  • Size 898KB
  • SHA256 8b052861fba7933b8963bc3fc428dd51b549f07c985fda693afe5ea2ac39cf3b
  • MD5 3dcf5e9d7df3365e8c33641790b465cb
  • SHA1 f52d62e150e49362e5112c187ba063f7408abe2f
  • SHA512 0a0c7159d423cf24cc21563ff2f0c752db10a8fc0cf52483b6d6c9f3a40d66739131ca24cd5e801c80410abd85358a33a207f1c3c8ab774d95b00bd8cf35db4a
  • SSDEEP 24576:HzHpguQDwTzegkDe6PPCmPK3JPpJPh++UvQdgdUgVictow:HzHmuj2gmtORLUvxFQc5
  • TLSH
    T1F3151230639ECE2AC4ED07B94871D33813F68D6EB112D3478EEA7DEB79967C24944612
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdiscoveryredlinesectopratinfostealerrattrojanadwarepersistenceransomwarespyware

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • RedLine payload

  • SectopRAT payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2