Extracted

• • Target

    tmp

  • Size

    88KB

  • MD5

    a3d6ec93a72892f8617aa52479e25288

  • SHA1

    effd448f53b2cbd7686ec5fdf09fc417957fc16d

  • SHA256

    77d67f012ba8a050c1885f2ab7b7b9057c1af8720ee3208b144526e1ea1652d4

  • SHA512

    961ea88112aae0198f6760de147d9a3d98ce2d4e833a8868eaee2c4e40c0504f5f8052b9c87843960642c795d31132cec2d3a391d5aa43f8a2d7413726214d7b

  Score

  10^/10

  asyncratneshtadefaultpersistenceratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2