Extracted

• • Target

    790d2773e6a7ab6c925661e008dc57d5.exe

  • Size

    556KB

  • MD5

    790d2773e6a7ab6c925661e008dc57d5

  • SHA1

    96056d53acef34d5f75d93c86fe38a4027923443

  • SHA256

    528a540044eb5dfab9ecbd301a63c69c930eea01e090eddd57a38e2cccb325ac

  • SHA512

    4ca8fbbd20674a7cd8d6a8cd54ddbff8510c5802030f1c9086f8bd939523e8b6a0bdc148711184c28c60771de059e51bef22a6167963577f0d060e397580e46b

  Score

  10^/10

  neshtaxloaderea0rloaderpersistenceratspywarestealer

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2