Extracted

• • Target

    6c9f4ba3599f8d3ee35d7eaba9e2d03cf3e97b7618620e57e5027dc104f750beN

  • Size

    3.2MB

  • MD5

    c4b83da0716a2f2036f6a6d389644230

  • SHA1

    ea1db48128561ff346934cff2c397f633516800a

  • SHA256

    6c9f4ba3599f8d3ee35d7eaba9e2d03cf3e97b7618620e57e5027dc104f750be

  • SHA512

    65bd4285fc74db51bef9ca08990876fd9ef6ac300ae308c189093fa302bf9821585178a2b3a0d106a823ab989a80144d9c023e677935c6be71b9a42b6c55011e

  • SSDEEP

    49152:CEuq6IQWg0Clzl9iRsSp8Z2NJN9uAbaFa7PM6tO4Ci9/sE58JjMs22voBuGIFOMB:CFqvTg0ClDihxzusBOMYQyvMuGxMR/

  Score

  10^/10

  neshtaxwormdiscoverypersistenceratspywarestealertrojan

  • Detect Neshta payload

  • Detect Xworm Payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2