Extracted

• • Target
    f52ae5e6bfc76f9ea38be634ce95f6d599ca39c643bc6b8fda09a62213e01cb3
  • Size 95KB
  • SHA256 f52ae5e6bfc76f9ea38be634ce95f6d599ca39c643bc6b8fda09a62213e01cb3
  • MD5 390fc6c7c2b8f8d411f425a8e4ccac38
  • SHA1 a61674f6ef386be9c89d42dc8c7fd50a2f775fb2
  • SHA512 0c4fff1b0ebbedc63df667740151f5fee3dc0a5025cf9681f2915fc3667cfaa473cbd5ecbd4515dc9c28b8c2f8915c2e3cc0776031ee7e1ce58b64389854dc04
  • SSDEEP 1536:FqsIhaqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2otmulgS6pQl:DGaKaYP+zi0ZbYe1g0ujyzdMQ
  • TLSH
    T11FA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B866957EF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  20250129discoveryredlinesectopratinfostealerrattrojanadwarepersistenceransomwarespyware

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • RedLine payload

  • SectopRAT payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2