Extracted

• • Target

    46c67c120019075d0f2844d6ae5ca36b

  • Size

    88KB

  • MD5

    46c67c120019075d0f2844d6ae5ca36b

  • SHA1

    2f5eaea257941502651d05b61f62f4d5034a80ae

  • SHA256

    8c7068ecf9168d899f1e67971f0f20b590ece3c4e60d45bc0a90100eb111868a

  • SHA512

    993fecdb07f1bb27cd7bf50623c935e764ced31727e7fcd73ce2de5a55c52115bb6b44316721f0bcc429de7a63ff73ab07a052c0c088d3723ff59ada75300dcb

  • SSDEEP

    1536:JxqjQ+P04wsmJCZkJ/ZVclN6PIeZtKDs4zb1NJcz:sr85CZ0zYAIeZtQrzb1C

  Score

  10^/10

  asyncratneshtadefaultpersistenceratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2