Extracted

• • Target

    SMART 1.exe

  • Size

    146KB

  • MD5

    816c02655dcded0b037bc142076f41a5

  • SHA1

    43f394fdd26609ae05f8069885ac5633533d46de

  • SHA256

    24c21788676a5218a6a08ff211fe20bb292c9c89d60feaad64740ddb906d351a

  • SHA512

    083951e7887bad9af8acd87dc835a555f7a79e97d2e16ef34e5febabdb30f0cf214adb7b2032faa220bd04dbe1155483442d7f604b8868135d745c38467ef8c5

  • SSDEEP

    3072:sr85C8QOb1sG0+HbGRD5Ds3dKYJgv2MiXtO6Gb86iB:k98QObuG08bGdp0+v21XXqOB

  Score

  10^/10

  neshtanjrathackedevasionpersistencespywarestealertrojan

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2