Extracted

• • Target

    e3f75ff4efc39a4afa3b1e35bae5298c1405018c31339a9c4142f75789d3013aN.exe

  • Size

    232KB

  • MD5

    cc804131d5439bbc89323f02d7ece850

  • SHA1

    f0644c93b27c1fd7980ba5175ef63872d675479d

  • SHA256

    e3f75ff4efc39a4afa3b1e35bae5298c1405018c31339a9c4142f75789d3013a

  • SHA512

    0921ed4a96afd63542c76d3dc665ddc7847a62b206778e157b1825af5383089e7b5fa974320418f824054b34fdf326fc3c3d20785aa149420813a0b732d5e9a8

  • SSDEEP

    3072:rr8WCBvMsUCZfXyg6mB9NGtkaeDSBo822rUAqOVY5xu+RxF2ZWuqoOa2TRxFY4j0:nKppUCFfXiaXSBzrUpuyFbue/FY4j0

  Score

  10^/10

  neshtasalitybackdoordiscoveryevasionpersistencespywarestealertrojanupx

  • Detect Neshta payload

  • Modifies firewall policy service

    evasion

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2