Extracted

• • Target

    3dd7ceb0c44f0c9bfd84d802f8b9eee2

  • Size

    1.4MB

  • MD5

    3dd7ceb0c44f0c9bfd84d802f8b9eee2

  • SHA1

    d5164e7eda92506aa4ed9a2a21bf599d643402f3

  • SHA256

    affe23699997f46b33a4f43d8558d7ec89603460ecea2f98952527dbaf09288f

  • SHA512

    485fc4208e5f87bc3945df401d131370d0691a30a11aa2ecbedb9e28cc8ace456263477787a762d85a5d094faa9fdf458907792f041336eb05f4d24a0ccca8ec

  Score

  10^/10

  neshtaredlineexceleinfostealerpersistencespywarestealer

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2