Extracted

• • Target

    f7cb6d99da2237b9ab3c2545f00aa0dc4b2dfda9cdc9c49824c65efb154e853a

  • Size

    1.4MB

  • MD5

    8365e42574d2d4d21e9442c58d14023a

  • SHA1

    90d11f875cfd06a758b425a1c52b63bc426a77f1

  • SHA256

    f7cb6d99da2237b9ab3c2545f00aa0dc4b2dfda9cdc9c49824c65efb154e853a

  • SHA512

    e682ccfaca84deb03911fff659d755e34d280698ba5601702eb3b8e38a934edf8f6f5603fd591d250d749fbc84727c1e7b68116c1aa1e45a111e24609d4b10c7

  • SSDEEP

    12288:Mls1nC+xpwcRrabrMoQ3Mls1nC+xpE05uuML+CHz7mjiuCzQl+D387h+y9PB22lG:PsnMoQ3PilNbzqMzQADs7h+EJJl

  Score

  10^/10

  neshtanjratتشفير كلين xorevasionpersistencespywaretrojanstealer

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2