Extracted

• • Target
    5ecdf9607af624d3ec1ed2bc9f0e9146.exe
  • Size 339KB
  • SHA256 934615bde495d4cbbfd0178c6eea46804cb19a447db1a8781bb43c5986012cbb
  • MD5 5ecdf9607af624d3ec1ed2bc9f0e9146
  • SHA1 d68079d495932ef242efc76e96fe6d75a1ab8dc0
  • SHA512 b7fe77eb6f6fbd620a5a7d187d1355fb43ece505d46846703ea71e84205fb6511867756552202a5b95163cc651a5ab9a14cb1b0c13e50260a5c57993df39835c
  • MD5 SHA1 SHA512

  Score

  10^/10

  neshtaxloaderp08rloaderpersistenceratspywarestealer

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2