Extracted

• • Target
    0feba92ff632640e738c770d3eb69ee1e287a54fb86c50bbcd2d0a9114b8539c.bin.exe
  • Size 388KB
  • SHA256 0feba92ff632640e738c770d3eb69ee1e287a54fb86c50bbcd2d0a9114b8539c
  • MD5 dc3da04d1159f3db53d4e205d214edb2
  • SHA1 169892fe651e572a0a50708dfd06201d42f57662
  • SHA512 fcb2a1b54493f8935d9b71e28209f6c48bfe375acfbb7664cf1ff6e39595e8b1dfed6173d440b2749a44bbb490a848ca52daaad1145ec0a63a9965b11ec29d5d
  • SSDEEP 6144:k9rI7T8AzZV2MYORbAV9bQdnXgfyVQhAyPlb/F+bs7:LIkEMtiQdwfyVQhAyPlb/wby
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  icexloaderneshtaloaderpersistencespywarestealer

  • Detects IceXLoader v3.0

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • icexloader

    IceXLoader is a downloader used to deliver other malware families.

    loadericexloader

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2