Extracted

• • Target
    SWIFT TRANSFER.exe
  • Size 1.0MB
  • SHA256 0112a299785ef16cc0d6b84bf084a0122a700788180242afae4dac3b40a2bb50
  • MD5 397cd818297d991cdd6497572d261a25
  • SHA1 11cc48c47f1aac9af6ed1e15f66bba98899581b9
  • SHA512 c683a1327f887c8e82eb032df862c84e3faa58dcfa9ff37ad5d7fd6287a356e59ae32b8512862f88d03bf8d63b71a95682343c8d3d982f76c3ce398371ebcb4f
  • SSDEEP 24576:pO9cxPuT2Vj/wgFXRtl+btB7QVdWfXDE1MIz53u:pOV6Nz9YbATWvDlIN3u
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkcloudneshtapersistencespywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2