Extracted

• • Target

    91d10089fdb8b6f9aa6a51c6f9b494ca751e117de909d5e38e3e185bb665d75a

  • Size

    821KB

  • MD5

    787709d6e539595f98261ba53a1b6a38

  • SHA1

    5aa7c7c9ad1bab83a325bd837d8986979738036d

  • SHA256

    91d10089fdb8b6f9aa6a51c6f9b494ca751e117de909d5e38e3e185bb665d75a

  • SHA512

    a06fc6dd142d60254bf361981f50a292ebd8ba8bf3be9188d2e25891c0d39926bbad0c40c4d909a468eebf78cd9cf8cdfd22d0c10cacd8d5fabf97a96ddc4945

  • SSDEEP

    12288:9pJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9dhWNUMS9:DJ39LyjbJkQFMhmC+6GD9HVn9

  Score

  10^/10

  neshtaxredbackdoordiscoverypersistencespywarestealerupx

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2