Extracted

• • Target
    0b2f0ecebd630d8cd280e06220b7918919577af9f0eac0443eb516d534985fb6
  • Size 749KB
  • SHA256 0b2f0ecebd630d8cd280e06220b7918919577af9f0eac0443eb516d534985fb6
  • MD5 5a89de06f804abc0470b2e0a8022bd0e
  • SHA1 d519a522d3b3974d517ac9d4094f33072ba07001
  • SHA512 bbb29faf852f2f0d22b4e93b50f72d9fd198cc1cb7a4f3a6f874f0938482ddc59ead120975ed8b0f3bfb7c2e23925ed00415e4e05ec7d0c5acc94ac1451d3791
  • SSDEEP 12288:QezQTans+DA3Qeefn2Y+12SHD69egW9RgvlLYezBy1MZIUD3O+hqqUIUH2QInA:Aks+DcjmL+Hu9tb1lzBy1MZDDPHUaQI
  • TLSH
    T13EF423581A25D017EA771F764C62E238133E2D8CE951DB47DFCCEFA73AABA544A02350
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdiscoveryexecutionredlinesectopratinfostealerpersistencerattrojan

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • RedLine payload

  • SectopRAT payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1