Extracted

• • Target
    9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d
  • Size 4.2MB
  • SHA256 9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d
  • MD5 1f5691e94e5733304c39b589ae5dc1cc
  • SHA1 c40fcc3c3a7777548eb8aa3e85a5340a5f304422
  • SHA512 ffc158b85cd06fc02443ab463adc9942a66e16dbac987297f9d977c236599224a5ca9973bb0868911a6e404b524ff2cdd7c4b3aad05cee71800e8e2ad8688436
  • SSDEEP 98304:jnsmtk2aZmtk2aOmtk2a/mtk2aXmtk2asGjnrn+nSn9:7LN8zLCTAc9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  neshtaxredbackdoordiscoverypersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2