Extracted

• • Target

    2024-10-21_eb5c04fcf61f943270e9a73d72a4bb53_hiddentear_neshta

  • Size

    279KB

  • MD5

    eb5c04fcf61f943270e9a73d72a4bb53

  • SHA1

    5a5d57cafdad9b8aee9dd6967a00a0aa228d4f08

  • SHA256

    b14613da1af90d6b88d2d62240b055f861b397529aeba63708586f3c25289aea

  • SHA512

    08c3d7c00516a8ff1136b5c52bda1c22fd018e4f0497a5cd69d92a66a437bcd0c6e9b1494d292a78fbaf4f26a1a69e864b5229377622fab037b30b669fc8c5e0

  • SSDEEP

    3072:sr85CtTF9Kw/kxLk42s/8Y31/Yvi9GA54IkMwP5gMTmmsolNIrRuw+mqv9j1MWLo:k9tTF9KxLp8YFgvwmZrTmDANm9zHMU

  Score

  10^/10

  asyncratneshtadefaultdiscoverypersistenceratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2