Extracted

• • Target

    2d57a1af420a6840d8361b9cd76be267.exe

  • Size

    136KB

  • MD5

    2d57a1af420a6840d8361b9cd76be267

  • SHA1

    5282d8171a4f994ae56f291bc51462a9a2bb5daa

  • SHA256

    fe7c7abae0e36d9582e6189d6405a221924a3006805c5768f9244cf56fe20e53

  • SHA512

    6bc2ccf373779937486a7c66a6d51e67043f9defa8ef28cfb8e8271a105c6a0b40478bc68d13f19e8a19b8c9234954e7bbe93e1f63a0e93fb488f64c7add060d

  • SSDEEP

    1536:9xqjQ+P04wsmJCmzi0Zb78ivombfexv0ujXyyed2n3tmulgS6p8li1qqsCbqDylI:wr85Cmzi0ZbYe1g0ujyzdX8iYEwiYjV

  Score

  10^/10

  neshtaredlinecheatdiscoveryinfostealerpersistencespywarestealer

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2