Extracted

• • Target

    0feba92ff632640e738c770d3eb69ee1e287a54fb86c50bbcd2d0a9114b8539c.bin.exe

  • Size

    388KB

  • MD5

    dc3da04d1159f3db53d4e205d214edb2

  • SHA1

    169892fe651e572a0a50708dfd06201d42f57662

  • SHA256

    0feba92ff632640e738c770d3eb69ee1e287a54fb86c50bbcd2d0a9114b8539c

  • SHA512

    fcb2a1b54493f8935d9b71e28209f6c48bfe375acfbb7664cf1ff6e39595e8b1dfed6173d440b2749a44bbb490a848ca52daaad1145ec0a63a9965b11ec29d5d

  • SSDEEP

    6144:k9rI7T8AzZV2MYORbAV9bQdnXgfyVQhAyPlb/F+bs7:LIkEMtiQdwfyVQhAyPlb/wby

  Score

  10^/10

  icexloaderneshtaloaderpersistencespywarestealer

  • Detects IceXLoader v3.0

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • icexloader

    IceXLoader is a downloader used to deliver other malware families.

    loadericexloader

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2