Extracted

• • Target

    43810.exe

  • Size

    34KB

  • MD5

    3325932fba61e0f8d19d87e3da22b075

  • SHA1

    a8d06733d83de73da64ae6f8bef39a6bbbd1e2ef

  • SHA256

    3933a6053d10ac2a6d87e7286adb069a4e8f8a8348166b5ddf9d70cff64162e9

  • SHA512

    577524bf80a266a9c7f360560be01560248b1aa5e50d1deb5a1df9383103b5889f2f726bb05a45e9529398c52f2d63c484b76770c3db0fa32d6e695fc88c8333

  • SSDEEP

    384:pxaXVqG28uymzhzUuHnOmYxLm9SCwvHixdTX2VR8pkFTBLTIZwYGDcvw9IkuisoW:HaXUzPi9wSC4C+V9FZ9jkOjh//kp5

  Score

  10^/10

  xwormdiscoveryrattrojanneshtaumbralexecutionpersistencespywarestealer

  • Detect Neshta payload

  • Detect Umbral payload

  • Detect Xworm Payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2