Extracted

• • Target

    كركل كروم.exe

  • Size

    1.8MB

  • MD5

    2e591b7018d1b289707e487a096a4f86

  • SHA1

    1c8ce2c64944e9f56ed72f8f1314115bf4aa7b15

  • SHA256

    5c9428ade02a7ad9a3d887b8c244ae962c8891daa2446077345649f82da87d2c

  • SHA512

    ef32df169f9deeb26e45580cbdbb7fe16b78d6d456bcadafdc536c97a4e5a05ede4c616c1bf94473d7d4f2dbf0889065640c48190bc48302081cbae40ea9dbcd

  • SSDEEP

    24576:kB4Uzr6UeRmmZg8ADHWsJuFfo5jYbYzHSG/UpnMUnFz3Y/l0:Xw+

  Score

  10^/10

  neshtaxtremeratpersistenceratspywarestealer

  • Detect Neshta payload

  • Detect XtremeRAT payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2