Extracted

• • Target

    7c0ed0f2b7cd99e442029ff585c21403e6745533cb0fb6e2e9c62e9bd86f9ef9

  • Size

    821KB

  • MD5

    1a3b15a67092446a15258995e6fae3ac

  • SHA1

    ce717a0d35b775fd868ab148d85f52227cd0de6e

  • SHA256

    7c0ed0f2b7cd99e442029ff585c21403e6745533cb0fb6e2e9c62e9bd86f9ef9

  • SHA512

    587670a19a76ab3417b6e00a3b2d8c2654fbdb0d3eb965fd48f775c5fa113ce36856a8dbdb2c74ad587d7454c4dde24b7fd92a85eb147862a2f19f34c7737d0e

  • SSDEEP

    24576:WO2TlgLCI5LON9R4qXCd0mYESKoTGgiRYEW2oEds:WxlgR5aB46Cd15NiGNvWPEs

  Score

  10^/10

  neshtapersistencespywarestealerupx

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Nirsoft

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2