Extracted

• • Target

    2477.exe

  • Size

    129KB

  • MD5

    efc3056fc450ea6e1b5d3e584810a2be

  • SHA1

    30d2d99c97d06c9d1a48719e65dbd381cf7fe096

  • SHA256

    5cc5def0f3bb96f67f39efa387a6cc5eaefa2499ddab4c8654e04390eaea9aa5

  • SHA512

    df04868eac6a924006a814552d713430aae5b638fb0a0178b79b512b8a1bfd50c58d6c209b306fdecdb208e8a5784bc14446e39555fb85437f9cbddf478fa58e

  • SSDEEP

    3072:zr8WDrCBZaPgXbXbn/cXVOOZu0eKNDqmFg:Pu/osbr/j0BFg

  Score

  10^/10

  neshtaxwormdiscoverypersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2