Extracted

• • Target

    3a923993e88010cc912d2784a3793855f7c362fe5e06ccb067c3dfce4155bb56

  • Size

    129KB

  • MD5

    e8c9a2905b86ab77e6a0db50ecff3c10

  • SHA1

    ab3a02c180404722d399e671ed4b1973bc03c8ce

  • SHA256

    3a923993e88010cc912d2784a3793855f7c362fe5e06ccb067c3dfce4155bb56

  • SHA512

    d213916918dc973dde4df998e537bfa2f5c97e34eb5172e860f0dc12a6be2360357a8d134dbb843536362263a153e34e2f3173a997ad119c61d4359a190b8542

  Score

  10^/10

  neshtanjrathackedevasionpersistencespywarestealertrojan

  • Detect Neshta Payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2