Extracted

• • Target

    Ref Swift Transfer.xlsx

  • Size

    186KB

  • MD5

    99433830e4ab9d54a431a440f57e1ab9

  • SHA1

    e997077f8cec8e3055dc5064e4b75db4ea4b4645

  • SHA256

    cd8e870fce0c84649d1cbddfaae7d5c983a6165475f6d9b2f845c48a678dff8d

  • SHA512

    d90f47ad8a95f72aa7bb522ef80bd4fc91cc6ccd198b1a801083bb7a25c8bf625af3842e41dff0e5f17674de65d2576482f8f80d908fcfce0cba2568987540dd

  Score

  10^/10

  neshtaxloaderqw2cloaderpersistenceratspywarestealer

  • Detect Neshta Payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2