Extracted

• • Target

    d51d58e678f0955cad08b64397c5c24758d7c7ec85e3c26bba51678301a5679dN.exe

  • Size

    9.1MB

  • MD5

    5f5a59388cb0c21980392e79117aa430

  • SHA1

    b8ce8db28d2298af9595e9431d4ecd86c57fffc1

  • SHA256

    d51d58e678f0955cad08b64397c5c24758d7c7ec85e3c26bba51678301a5679d

  • SHA512

    211a5d0dfbbdbd3c1e5461d2a1e2a83e0e26ec95df506b5f058eca66f1c2f43d82e0c3363be77883c05e3a6606e7a40e14aeb75ce342e4c187f0724d3ea657d4

  • SSDEEP

    196608:qMgt5LKUjY+A1QtCopK7ogW5o35+VqmXaEvNTWc3KFKxJS+9:VA5WUs+A1OCopRX5y54qmXaEvNTx3KFU

  Score

  10^/10

  neshtaxredbackdoordiscoverymacropersistencespywarestealerevasionprivilege_escalationtrojan

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2