Extracted

• • Target

    beb40f15a8e3f87a5b1cd4eec3c60663cdf207829ec222739bd2a1368d3874f4N.exe

  • Size

    181KB

  • MD5

    2ca171996ac8ddc3c3f813f046c4edc0

  • SHA1

    37537086d2cb222b2afb0bf11cdcaa154f5431dd

  • SHA256

    beb40f15a8e3f87a5b1cd4eec3c60663cdf207829ec222739bd2a1368d3874f4

  • SHA512

    56fa5020007408fdf621ca9b56a426050f6766f74c06022d9413eaf472e772372ac1d593a1c5989fd0e33cfc7a93d9339953eb9fc0b7d3b95c54eebb983546dd

  • SSDEEP

    3072:br8OCtBbAEezczqGpkN6/7G4EU4C1Fok7kO/HdqQU1Dpv5tFA25ZA1J6Ho5:Xat+Eeh6/7V2UGk1/9y9pvrlA1r5

  Score

  10^/10

  neshtasalitybackdoordiscoveryevasionpersistencespywarestealertrojanupx

  • Detect Neshta payload

  • Modifies firewall policy service

    evasion

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2