Extracted

• • Target
    Crack/NUP.exe
  • Size 3.4MB
  • SHA256 c59b24b4f21fdaafb37b52c0c34380ebcba4ee0cb1764bbf6598aa4fd023e94f
  • MD5 762dee0400bd8921b84d0b955bb9404b
  • SHA1 eb00dee1dc4410a440985c9bd50877c6726fdcfe
  • SHA512 6498ab059cf52b802a65aa2642594ce20b60b68280dcc6f4218b94f4120de3129f34ffaa27c62efeecd72bcf0003f30417430b2ec09b5c416b0e3181b6bcb703
  • SSDEEP 24576:LXWpacOQZXJdIT7MBlbPF+Scw4JbvlVv4zHS5/neHArC+/6C0px8fxu/j6Z/z:L8XZB9PF+ScwCP4zyJ++yPx8fGj
  • TLSH
    T1E8F58E45373F887DC41686BB2BB308D06A681E5C41C4961E78DD76DDBFF5E82026B28B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Crack/SMCommon.dll
  • Size 925KB
  • SHA256 edf62e66eecc1b188de94ea77496661d2b35eba85217d3906199828226c47d2f
  • MD5 9d9c873850351ebdd34babc4fdbe0149
  • SHA1 451ab0d14c046e7126fc9a15c6efd6e12d4ba89f
  • SHA512 eb98293c45f7843fca1b3463311a3e92c77127904d5d51b026f5620fd1e1256f634d4ca390a43e5a9f6268eb4507e7950de02622c461d8c3b3f8d55673ae8265
  • SSDEEP 12288:Wc75ZoYvRqhvNE4aqGCArEUvnfETZ2WUtuD1ntNt:5vvi1E4CTrEUvfETZ2W7D1t
  • TLSH
    T1B9157C03F755CA7BC06D8B38E5E21B0A1B75E941AA53D74FAEC8749C5CB33C11E492A8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Norton Utilities Premium v21.4.5.428 + Super Clean Crack/Setup.exe
  • Size 700.0MB
  • SHA256 4dabd7a2017b1340c004873cee20f51dcce1039e94a44b2d6803f8a101682167
  • MD5 c69fa995cdf2593fdc56f46fcf28e34d
  • SHA1 cd88210d1bb7bc9c2596388634a5f3712d3a8a4a
  • SHA512 10cf3bcb07e9bc904ed72577220cc8d1f5464ca2993981761df37521d3eccb327b84e97553c174adb386f0ab825c0902f521f2c36c8559f50ec588eeeaac9444
  • SSDEEP 1572864:tsVThtShCVQ01iJJayD3JCMSnqW2izy6wv9L:ShtShCQXJJaIZCMSqWpzyz
  • TLSH
    T14479333C6A0161BDE02F217FEC575D88F3F21D18D5318E0389986E53CC66B276AA176E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  195captaindiscoveryexecutionredlineinfostealerpersistence

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral5behavioral6