Extracted

• • Target

    tmp/c945c4d8-65a1-4a58-8035-632fca52aa6a_vbc.exe

  • Size

    397KB

  • MD5

    023aae8d4a78eb3c9189e94336b4bae6

  • SHA1

    437a019e8b83a84da6ded500f8ca9cd4198398ed

  • SHA256

    3cbfb1f777724a6dded49ae440d80971994b98a51553880601529588717e0e47

  • SHA512

    42a0645f3fb023bd50128229fbd762a90fa53f146ab4d7b0ab283cd44a0da6effb2bbee583fc6ffcd636daeaad2373926e742f856c7d78d6742db782850b8fe4

  Score

  10^/10

  neshtaxloaderea0rloaderpersistenceratspywarestealer

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2