Extracted

• • Target
    d8daae08c6d13a0e57e53df3dacbbcd230100dce35b23b1bc37ed1b09dd41b1c.bin
  • Size 627KB
  • SHA256 d8daae08c6d13a0e57e53df3dacbbcd230100dce35b23b1bc37ed1b09dd41b1c
  • MD5 40095b4f47ba873807c183b1455e37f1
  • SHA1 1fcbf61c15ab0ac975b9310fa117bdb400259fd6
  • SHA512 5080fd0ccb86c8e6947f736f41b2947e63de358ecb8b1de5b7253a7d10b4ce1753421c9d1e0581168fbedb71e52d1a3488993f53ad0119bd3438028fb9ea5beb
  • SSDEEP 12288:0qlUMN3eceK/1hUqmt6TFzPnOykfMY3llH8k:b+
  • TLSH
    T180D40FFDE84C5853C37DB93A12BF8E3A93244D96061588C5E0B179E23F533867E8985B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  minediscoveryredlinesectopratinfostealerrattrojan

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • RedLine payload

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2