Extracted

• • Target

    a9704735e10e7b769bebf6b33f8fd17d8a1f2d97ef774bf2f8d3ff3694ccf6d9

  • Size

    482KB

  • MD5

    81b76350a44f6356246271612e6f23f2

  • SHA1

    bfafb16fcc983399191cf2596d700aa03ee6f75c

  • SHA256

    a9704735e10e7b769bebf6b33f8fd17d8a1f2d97ef774bf2f8d3ff3694ccf6d9

  • SHA512

    e275f3b36eff3788b3da3a8c05002660e8454e44ddd1ee4a38c85fe54d310c61ffc7228026f74b1e33ac1bcab5144cb65a289566229d1524f46c75d9e6532b1a

  Score

  10^/10

  neshtaxloaderea0rloaderpersistenceratspywarestealer

  • Detect Neshta Payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1