Extracted

• • Target

    NLBrute 1.2 x64 & VPN - KeyGen.exe

  • Size

    2.7MB

  • MD5

    b5ab8cc485d3d593884cf23097922fcf

  • SHA1

    94db6a99f0ccafee1afc706206e6064330c131fc

  • SHA256

    1c6fe05278c9d74ecf0f6d76636a7945f2d72427dde2fdf3deac27fbb3272815

  • SHA512

    7097d2d03e9820d5c930af5b75496b8e194f68097d3e1f0c70d46b8d743bbc504b02e2f429c4183e5fe0ff223cd200d3c22972691838b81a60da6a806b8f5d15

  • SSDEEP

    49152:9eaxJWyY37qalukLrykLYK6KdMea44rbnpVInLHA/Zy0GJudSZkAg1Gs/zBhB2vE:9Jxs7qpOykcKJdO4czboTQ1G8SucshA+

  Score

  10^/10

  neshtanjrat(01bx)persistencespywarestealertrojanevasion

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2