Extracted

• • Target
    8cde3e5031f19555aea0c8fffcc3c4c2
  • Size 221KB
  • SHA256 a95037039a9920384aa6b478ca54c7d839c72b203c5331a7ffbd9e0f9731c3dc
  • MD5 8cde3e5031f19555aea0c8fffcc3c4c2
  • SHA1 a85f99bf9fd281e85959dd98c6ebfbe0066b4eb5
  • SHA512 5a6032ad58db8acf9bed16cb2dff08c8a2788c9bb2b86de1de82632671805133a21eb9306d8f45ce885adb94aedcefbddc5372f8c4538dff4497ddab9c8bb842
  • SSDEEP 3072:sr85CdUYGtIZz+8oCRMy6Fa3fpEifN+r4DWSmDrIC2ox5u:k9dGOUnag0WSMrA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitneshtabackdoorpersistencespywarestealertrojan

  • Detect Neshta payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2