Extracted

• • Target

    9be32c3e84f9bc932b49dc6613ea151160db1b297cc48f50229b632b9ff11182.exe

  • Size

    199KB

  • MD5

    f77fd46f7a4b2c6e5aff3191aa0e8a55

  • SHA1

    b90f92f1bd75b977e63ecdebc78979542f13d617

  • SHA256

    9be32c3e84f9bc932b49dc6613ea151160db1b297cc48f50229b632b9ff11182

  • SHA512

    8b5a5483508777538c8017d1d6a37656e56a3ec913737154c66e76b70d403fdf347b8303fae1e45d9b2bf8fac2dfc0096f4ade3a543fcd6214efcd9aad32fbcb

  • SSDEEP

    3072:7r8uCJwMEHdNOy+eP/rM71eYQUXlqBRfpj46MQCcA5Cf0Gy4i8qQtHSUgmA:3CJXAkp2r+QUXWS6MXi10KA

  Score

  10^/10

  neshtasalitybackdoordiscoveryevasionpersistencespywarestealertrojanupx

  • Detect Neshta payload

  • Modifies firewall policy service

    evasion

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2