Extracted

• • Target

    a65cf9ee76d9f146f847f848a9f736ac9fb4444db5bb9c9341a83c38a4ccf943.exe

  • Size

    612KB

  • MD5

    ba287c26a6c5cafe168e8ac392381be2

  • SHA1

    acabd610f68bd6a288d42916afd0194898f53d75

  • SHA256

    a65cf9ee76d9f146f847f848a9f736ac9fb4444db5bb9c9341a83c38a4ccf943

  • SHA512

    494166f4872b2b589c85fd36140ca667bb8766dbd65eecfc6ab110a679f581dae243c68cc09f96e32c2a10e7918475a46f1987db731a10e647cde1106d8fdb5f

  • SSDEEP

    6144:XNrgqE3QZ4/KjrWFiU6K73uZwUlgWPMOHSSj80i7idui1Yl6ns3hk:2U4/hFis73p1+OGgi7ghk

  Score

  10^/10

  neshtasalitybackdoordiscoveryevasionpersistencespywarestealertrojanupx

  • Detect Neshta payload

  • Modifies firewall policy service

    evasion

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2