Extracted

• • Target
    00d0f313cfa2a66641fb47807ce5f85ec7ca03396746aa791fed388e00cd3db1
  • Size 1.8MB
  • SHA256 00d0f313cfa2a66641fb47807ce5f85ec7ca03396746aa791fed388e00cd3db1
  • MD5 22bc47eae110ad147074986df9b27d9e
  • SHA1 f5dff26c280ea38eed964715fec6e1cfb11ddf56
  • SHA512 17a45c62e53a2879b274b843dd5dbf3d33e29036f993e3b2b3d6a9a86ac4f9aedd7fe3664fa76149e952e0842f8b25cc1183dedc2eaa6aa13b0ccde66a32fee0
  • SSDEEP 49152:asRt3Zuq8oChJNIVpOpp4eSKaKAyDpDh:dpfChJNGReSKZ
  • TLSH
    T1D785330502E17B5DDDA851BA9EF67F204F249F1725B0ABF0DA8DF3081EA529D0F86A50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nice worlddefense_evasiondiscoveryredlinesectopratinfostealerrattrojan

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2