Extracted

• • Target
    Redeyes Minecraft Checker.exe
  • Size 1.2MB
  • SHA256 4f34cddcd5792c3afff2880f5d84c8ea452b8b7d9ae5e38d1b98486227b4f0d9
  • MD5 94db1d8338fb3c9f917a5613db3d4071
  • SHA1 1514b3571a69d7873287b71ea85fbaaad730b627
  • SHA512 bcb20cd62d9722caeb3d70770db63bd35754c0b1c8327a3a8db9babdc55f0729038f1f0d20aa657a909039d165aa3aefc22b57e4011a045f1fa64466b50b4106
  • SSDEEP 24576:MHl0lSkKuiI0FeIqgKglBRRt+GtlrgDBoCLTanYqUdQqVt/r:MFWSB7OIOglBRRtZvrgDBoCKnadvr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesectopratultimatecrackpackdiscoveryexecutioninfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2