Extracted

• • Target

    89609c41c0c13302695dec877a6863737243e22b414740e0595f62a0c4d1362a.exe

  • Size

    1.1MB

  • MD5

    0b7d3217ae50a0433b3a96494d089e05

  • SHA1

    012822d29e1ec200b9cf23e10cb0d8a380ec4da6

  • SHA256

    89609c41c0c13302695dec877a6863737243e22b414740e0595f62a0c4d1362a

  • SHA512

    14a2558b3b56fa9f0f1c31dfe2d65cb5b2574c72f16240b94a642be738d1df49d212ebd94a2440aa8c32ba99d2c5876b632a69027615021f2a5bcc552b8d0888

  • SSDEEP

    24576:6AbXH84DRnKCwyElWCAMmKix1x1IDStOX2cBZ8umx7QgbcxWsG2Emy:DL8uokzK6DxcD8uqzbcxWX/my

  Score

  10^/10

  ffdroiderneshtaaspackv2persistencespywarestealer

  • Detect Neshta payload

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2