Extracted

• • Target

    ee50e046b2a0adb88a996e57985071c19c7ab67f8947d5b3c30ea992c68538f8

  • Size

    116KB

  • MD5

    7b6abc0d6b931231f4e6caabb14133b9

  • SHA1

    c43d5a406ac73e91713856f99293d30b8c5ff05b

  • SHA256

    ee50e046b2a0adb88a996e57985071c19c7ab67f8947d5b3c30ea992c68538f8

  • SHA512

    2e93cd332214b6af4b86097d5453f7cd06618d0e8aaf0ea7f5d9ef3bae99c37fc2e0c51236f5aa6a92b6da94c0b5575e0f11a15f080cfa9d355c935b82f55e31

  • SSDEEP

    3072:sr85CrCtNKzZm2QJJ5R3JMchcEimov8fSgju:k9rCtY8rbhPfoxou

  Score

  10^/10

  neshtanjratمہٰسہٰتہٰشہٰار عہۧزرأئہۧيہۧل ضہۧآغہۧطہۧهہۧمے evasionpersistencespywarestealertrojan

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2