Extracted

• • Target

    ccbb75beff1c9e6dedeaef2597f67aa1b8416a477df483eaf7f4688ee50fc8f7.exe

  • Size

    181KB

  • MD5

    2383d1904be6b9428784f6240a2cb50b

  • SHA1

    14a36cfccf516d1d3cc2759395e598865c08c5bd

  • SHA256

    ccbb75beff1c9e6dedeaef2597f67aa1b8416a477df483eaf7f4688ee50fc8f7

  • SHA512

    c2be91738481e091b28394537714a5561432637955b943a2bdd2df7c6d82cefafe8d2350f043e59a358736daa1bcf96ce6fa7c977fc542dacc2c963bc31f56be

  • SSDEEP

    3072:br8OCtBbAEezczqGpkN6/7G4EU4C1Fok7kO/HdqQU1Dpv5tFA25ZA1J6Hox:Xat+Eeh6/7V2UGk1/9y9pvrlA1rx

  Score

  10^/10

  neshtasalitybackdoordiscoveryevasionpersistencespywarestealertrojanupx

  • Detect Neshta payload

  • Modifies firewall policy service

    evasion

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2