Extracted

• • Target

    730896aeaa4730c97fe2bc6b5921883814a5fdbfee12b4184636f63c295c90aaN.exe

  • Size

    612KB

  • MD5

    65a4bc0fd559bf65b908428f4a085c70

  • SHA1

    be380d6a3cec530fa8f9429cf91e9d3cac96d67d

  • SHA256

    730896aeaa4730c97fe2bc6b5921883814a5fdbfee12b4184636f63c295c90aa

  • SHA512

    017e3106542683bb1313aaafb5ab5cac05f798cddf8119446482bc6a7a5ae167b989c3d08dd86436842200cbc8c8b86fce428d6e8ab3f37d6b07b7cb7502f8fd

  • SSDEEP

    6144:XNrgqE3QZ4/KjrWFiU6K73uZwUlgWPMOHSSj80i7idui1Yl6ns3h8:2U4/hFis73p1+OGgi7gh8

  Score

  10^/10

  neshtasalitybackdoordiscoveryevasionpersistencespywarestealertrojanupx

  • Detect Neshta payload

  • Modifies firewall policy service

    evasion

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2