Extracted

• • Target

    a22694ecc330877c14c622a338f099d5.exe

  • Size

    3.5MB

  • MD5

    a22694ecc330877c14c622a338f099d5

  • SHA1

    c41f047be2b696dea3184b7ebffe647079f3954c

  • SHA256

    53fe510daa3712b64c24d8f30658e1408929369735c50cc3bbb61e26c55d786e

  • SHA512

    b16f22efc084dbae29fa363430362817b7868807309a789ac65b33d68cb460db6455ba1ab5dd1484e87afd4ba3fcb1dda66688d6a7c97c4d911d3fd580b5d8ec

  • SSDEEP

    24576:NSpM9XJSnFTGkzgB3uz60e5Lb1HCfLSovTaCqbvF+WKzQqW/pt64Y5v7QHuHOhHc:NgHny3COVb1HCfLpvKqV

  Score

  10^/10

  neshtaraccoonfa72f4c1fbe65cee8651140fd47267bapersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2