Extracted

• • Target

    bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb

  • Size

    744KB

  • MD5

    a3fc29c6698ca5989e265daec8747bcb

  • SHA1

    dfa0fa264b796d564406f21af73cb77e2f5fe22d

  • SHA256

    bc2f593e8245d9295aa8fc8329e2e740709f517ecce2647869b110f272de28bb

  • SHA512

    3e0e79fa91b7a3b8fffd59763ce39203c8e88bceed64cb4964592738546fc2050210cf76df591cfe4badbf76bba9c781518102cc53836e6df09a77497d7e246e

  Score

  10^/10

  neshtaponypersistenceratspywarestealer

  • Detect Neshta Payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2