Extracted

• • Target
    790d2773e6a7ab6c925661e008dc57d5.exe
  • Size 556KB
  • SHA256 528a540044eb5dfab9ecbd301a63c69c930eea01e090eddd57a38e2cccb325ac
  • MD5 790d2773e6a7ab6c925661e008dc57d5
  • SHA1 96056d53acef34d5f75d93c86fe38a4027923443
  • SHA512 4ca8fbbd20674a7cd8d6a8cd54ddbff8510c5802030f1c9086f8bd939523e8b6a0bdc148711184c28c60771de059e51bef22a6167963577f0d060e397580e46b
  • MD5 SHA1 SHA512

  Score

  10^/10

  neshtaxloaderea0rloaderpersistenceratspywarestealer

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2