Extracted

• • Target

    1f5b6285dfe03953ace1eadea6c373df2a651d88c51ea090fd0c9dd6e303d913

  • Size

    280KB

  • MD5

    8099427946cde9fc2bcb400dd16ad356

  • SHA1

    496b46ba79a45183b85ddf38512feed3fa094a94

  • SHA256

    1f5b6285dfe03953ace1eadea6c373df2a651d88c51ea090fd0c9dd6e303d913

  • SHA512

    e60e2d0d266088dbded3e7e0cda003bc633242d9140af70897b0d3f1c3c2d930b3b335b264bdb4c170fe2df5fd3133e602f98aebae074c6527949c1d7516925c

  • SSDEEP

    6144:/S0tF1GtJS4v3jcvRkpa3JzfcjP44XQhGLaVE84T:rtF2JSazkJQAoQjg

  Score

  10^/10

  neshtapersistencespywarestealer

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2