Extracted

• • Target
    da7b4c213039524dd2cd661cb20e62ae
  • Size 599KB
  • SHA256 7d9a7c06ad6bdf4b58d325900a940f3bf830862d108c8cf58d3d77982b87f8c2
  • MD5 da7b4c213039524dd2cd661cb20e62ae
  • SHA1 81ad9e9a3d24242fa7619ad23bb6eed117672a3d
  • SHA512 fb55d71a64138bc17f5e7a0c8f6496ddeeb0a156270a1de4b8c0bcee9920a46fef0beba34f1bd0a9d589e5a49ad9d1803b71245a9ec28414c956c594886555af
  • MD5 SHA1 SHA512

  Score

  10^/10

  neshtaxloaderbntnloaderpersistenceratspywarestealer

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2