Extracted

Extracted

Extracted

Extracted

• • Target

    50e028cead5a613978c91ced2d48c6c8.exe

  • Size

    400KB

  • MD5

    50e028cead5a613978c91ced2d48c6c8

  • SHA1

    f9252a5702dbbffc82f9b6d9f133cdc2d1a91355

  • SHA256

    2bf5be8c9b5e84d6eef09d6de968796a277ead7885cd96855f7637ddba987288

  • SHA512

    2bec275606e8facd66645fe45c01505e7e23314d1763e4ba0df4371593bc504f22cf8056824597aa64acd1de93e56eaaefecbf9b3fc0466c9906a02478239a76

  • SSDEEP

    6144:Nv0kF315GTFcbCW+Tnc5tjhAUcGIx0qa0Hv0CA02d0OyQR1N4GVU6M8qdS2vnTtz:Nv0a1j2Wj51lcK53U6CdSc2DLw

  Score

  10^/10

  nymaimprivateloaderredlineevasioninfostealerloadermainpersistencespywarestealertrojanclientsnam8

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2