Extracted

• • Target

    70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e

  • Size

    3.9MB

  • MD5

    c52d4fb4a49b05a1f665d2b9a4bb42ad

  • SHA1

    4165fc93089a1b3517088db400963df219af05d3

  • SHA256

    70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e

  • SHA512

    a312ede14b3a771d75de0060a7bb8c97787d99114a828cb8b98d734463bc0ceb365b1677f3e1a3936c24439e5436451c11335f3f3f3d5f1138e4da28f6aed557

  • SSDEEP

    98304:vjmtk2aw3jmtk2aH3jmtk2az3KK3dyaXXNJDWjBKUoLIkPeB1LnPnqn9:v+h3++3+y3b3rXXNJDGiLIkGB1zfk9

  Score

  10^/10

  neshtaxredbackdoordiscoverypersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  behavioral1behavioral2