Extracted

• • Target

    76c17a1b371fd2e93046ed8a2942f1f8c90aa96c03b5939a93ca9a7e8b429ef6

  • Size

    1.4MB

  • MD5

    2cf9e95347cbf156b261f55ab4b1ac14

  • SHA1

    9130b5a89ccf69dd339f5bba85a0a7e90f0c133d

  • SHA256

    76c17a1b371fd2e93046ed8a2942f1f8c90aa96c03b5939a93ca9a7e8b429ef6

  • SHA512

    a29f9881f5ba746876605336f6942d5382851ed9ebd0051ead9c6020583b0031ac165c4bc04c477718606b635fee7899a449f63d43ecf35f84f8ef4ed3a56b11

  • SSDEEP

    24576:xExpt3BRETk20RnLhgUqH9Vpw5bgxxlkkGd7YJKRfJzsarAobfU7rrYddLC49wZP:x4pT20RnV1i9rw5EuJZQqvfU7Ad08mP

  Score

  10^/10

  neshtanjratمہٰسہٰتہٰشہٰار عہۧزرأئہۧيہۧل ضہۧآغہۧطہۧهہۧمے evasionpersistencespywarestealertrojan

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2