Extracted

• • Target

    c1ffccb9eff1a60e6d5c984bbb447f18aa3872286f4dae3c4a513546c8e24f05N.exe

  • Size

    2.6MB

  • MD5

    b78e2c578bae5735a163d4c7f07edd20

  • SHA1

    31bc51da25b88d7f8eb8ab6a383c46d7a685b35e

  • SHA256

    c1ffccb9eff1a60e6d5c984bbb447f18aa3872286f4dae3c4a513546c8e24f05

  • SHA512

    3733cda9f98a2f3e3a4ed8f3c3c69678b27dfda62f29d214d61eff0662bf4e79ebcdc88c9aea8bfcb4207107f1ad94492504eef1a600c3292d57b762ac674ec9

  • SSDEEP

    49152:dnsHyjtk2MYC5GDzHyjtk2MYC5GDbHyjtk2MYC5GDRRDdz3sC4nYn9:dnsmtk2ammtk2aemtk2aoRDp3shnYn9

  Score

  10^/10

  neshtaxredbackdoordiscoverymacropersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2