Extracted

• • Target

    49140280d15498a146873199b563852f.exe

  • Size

    171KB

  • MD5

    49140280d15498a146873199b563852f

  • SHA1

    9d07b889da175893d72766cc9706f5a51ae04b5e

  • SHA256

    d5f162d4ab50a806c77d3462307ddaefb30135bb6a8ecbe75afc253a2c3cbd2c

  • SHA512

    f51b9d6b7b6f435daad0a512b9c68e6fef937a1fb30d0421290f829d3bab65c5c1c0630631049d5ce2cf9c99e539451f743499e982258cbfd213d2a3921eefe4

  • SSDEEP

    3072:sr85C2inW+ZBWwEGGXfbSwr+1SdHAeZ7ZoRwB4x7DOHw:k925+PWUGTzxZep7D0w

  Score

  10^/10

  asyncratneshtapersistenceratspywarestealerlmwkapo

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2