Extracted

• • Target

    b526d210f800d1d9a2f466224a977343d59f679eaaf16b9bcda4d5196d810de2

  • Size

    1.2MB

  • MD5

    8fbcc3f3038677646fb2e8838d48f14a

  • SHA1

    ffc3b09143e7e4322c1effee531329be6d104229

  • SHA256

    b526d210f800d1d9a2f466224a977343d59f679eaaf16b9bcda4d5196d810de2

  • SHA512

    91cf9d10d6aae9f70323cc1e136b4b6fc5e281c06af5c374cdcb2334b084f45b7abc5b1507bd08ed56bac62766d9eb39168dd409d8bb53ac9ed93ed8e1612b91

  • SSDEEP

    24576:TJ39LyjbJkQFMhmC+6GD9JA+vSoqYAQmZoftn8ln9:THyjtk2MYC5GDfBqoqYFm098n9

  Score

  10^/10

  neshtaxredbackdoordiscoverymacropersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2