Extracted

• • Target

    RedEnginex86support.bin

  • Size

    425KB

  • MD5

    80e2b33deef5eda9d1871e69937ee19d

  • SHA1

    ac5a893026a6d799f55fbf43e97b8ca8b6c3be35

  • SHA256

    218a1f501d61b425bf6dd32b89df2c39431ad5139be81ce50c4f0d5cb95e914a

  • SHA512

    48bf684c0195cb183172fa0a983f56d12671f7e697837dc703b342dac843ee0595196b9361a982c8bcdb48d2c9718c4e59fc510f700ad2d74fbe14ff2608d1c9

  Score

  10^/10

  neshtanjrathackedpersistencespywarestealertrojan

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2