Extracted

• • Target
    77419B9DE019B422054B6560B7114441.exe
  • Size 914KB
  • SHA256 d05986e4e8a5d6818ae373894b7af0e78fddd99c57d1b3b76357dfcafefc0cbb
  • MD5 77419b9de019b422054b6560b7114441
  • SHA1 d134cef036d35cdf137f08c7f8e838cedba7825c
  • SHA512 b159b97f26c449d355672c323edd2f80e908852cb2ff943bec4f8d083645aa822f308caf8ce992c7bfbb880effc77fde5833a7b7295fbf4f6c63183169123704
  • SSDEEP 12288:JPhRpqGkf4UfZNMywMadCJPzLes3t1fxSGWo31V/nbqRyoifTyrirJ1Pf:bR0wUfZbPGW/buuOIJ1Pf
  • TLSH
    T1A815E0701A04D981D5525BBBD921E3F837B46DB8D831D2138EEBBDBB783674018E52B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdiscoveryexecutionredlinesectopratinfostealerpersistenceratspywarestealertrojan

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • RedLine payload

  • SectopRAT payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2