Extracted

• • Target

    0651eb36fb416e496a4b43be732f87872d72cfa812beafa071515588c89f9c11

  • Size

    601KB

  • MD5

    679e100f630ae3a79e1750bc15498ad5

  • SHA1

    aeaead2657d304f8f7ec278da9e202764889dcdf

  • SHA256

    0651eb36fb416e496a4b43be732f87872d72cfa812beafa071515588c89f9c11

  • SHA512

    b567c93b679aeb3b578a7c861294cead35c685ef0df8ecab7d50d17db3615d81008520ad26748720d494c291ea5c8f2d839f0fbe667001af46ea0e2d0a82f13c

  • SSDEEP

    12288:H9OczTX1g+ACjgJ5Q+ON9R4qeACjdXE1cVKB/5EJz6L/tIoTGgsV:dO2TlgLCI5LON9R4qXCd0mYESKoTGgsV

  Score

  10^/10

  neshtapersistencespywarestealerupx

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Nirsoft

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2