Extracted

• • Target
    كركل كروم.exe
  • Size 1.8MB
  • SHA256 5c9428ade02a7ad9a3d887b8c244ae962c8891daa2446077345649f82da87d2c
  • MD5 2e591b7018d1b289707e487a096a4f86
  • SHA1 1c8ce2c64944e9f56ed72f8f1314115bf4aa7b15
  • SHA512 ef32df169f9deeb26e45580cbdbb7fe16b78d6d456bcadafdc536c97a4e5a05ede4c616c1bf94473d7d4f2dbf0889065640c48190bc48302081cbae40ea9dbcd
  • SSDEEP 24576:kB4Uzr6UeRmmZg8ADHWsJuFfo5jYbYzHSG/UpnMUnFz3Y/l0:Xw+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  neshtaxtremeratpersistenceratspywarestealer

  • Detect Neshta payload

  • Detect XtremeRAT payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2