Extracted

• • Target

    6ed53a0273682d74b8ebdd50fa1b2a19

  • Size

    98KB

  • MD5

    6ed53a0273682d74b8ebdd50fa1b2a19

  • SHA1

    131970acd7fecc7e753d28801e0c0796ba860002

  • SHA256

    4e7f0322867bf1c0fb7cabb018cf78a6f8522a19ba250e0d2824ce08a583c3dd

  • SHA512

    c6cd99133afd6791afac763ee5e45a58405a848be22f5cf5d5be01e6eb00c806e7cf0596f19fe3c1a3924e9ffe2c7b4e24f758cb575a4a65ea5e8842f5558288

  • SSDEEP

    1536:JxqjQ+P04wsmJCPp+bwbb4xqtl6vnyElSKTp3hrg9bdTW8V:sr85C9bExqtl6vnyEsKTzg9bdZV

  Score

  10^/10

  asyncratneshtalmwkapopersistenceratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2