Extracted

• • Target

    018a0cfe677b7b1e7697dd37b9eab1e040d93967e58cf3a850d48e0bf8f2c7c3

  • Size

    135KB

  • MD5

    0f53727f9996f49e6034837b3622ce12

  • SHA1

    9b167fab68afa5efc417537b4d6b9a3cf028d614

  • SHA256

    018a0cfe677b7b1e7697dd37b9eab1e040d93967e58cf3a850d48e0bf8f2c7c3

  • SHA512

    30bb029d98fec5ee4a5caf877614722c3865a259489c4593f1bd2be872b4a55b1f73299627c4f681b694fb7affa9caa5460ca5c4bd6933bf9f15b369a11e91ca

  • SSDEEP

    768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJaf8S0pAG6XCwDfPMWosI45NbFdwjJw:JxqjQ+P04wsmJCKpQCwDHM1sV/Tw1w

  Score

  10^/10

  limeratneshtapersistenceratspywarestealer

  • Detect Neshta payload

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2