Extracted

• • Target

    ce8db50913eff9d4e600312d7c446b4a

  • Size

    691KB

  • MD5

    ce8db50913eff9d4e600312d7c446b4a

  • SHA1

    6ed1b7efb1acb82b5856824a66b0a70af319109f

  • SHA256

    93b96a1511a6f2084db207b831e3e072d8e5a4901592db660d456d10e5f618dd

  • SHA512

    74f979d6678ab68b6063b8497f37303d41c0f084ee198d0260fd90fc28aa8a1e1cc55a8bcd65cff7c05338bc93e23b33767efa1d0c8974a1a3039916835d05e4

  Score

  10^/10

  darkvncneshtaredlinerunpediscoveryinfostealerpersistenceratspywarestealer

  • DarkVNC

    DarkVNC is a malicious version of the famous VNC software.

    ratdarkvnc

  • Detect Neshta Payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • DarkVNC Payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2