Extracted

• • Target

    2025-01-15_6caf2b470a324f74046b8c78d32358a7_hiddentear_neshta

  • Size

    205KB

  • MD5

    6caf2b470a324f74046b8c78d32358a7

  • SHA1

    d618e8631f5c20c49f4c848298fe62ee9ac179b2

  • SHA256

    788698e2f22300e5bee710b15ec7bea0f5d919feb5fee6ba2f0bec88153ffba7

  • SHA512

    1f40524412839be384b90a6eaeeeba1f0d181f866dd062a85535ba3e2022f425a9e145aa42f8dc26f6132a92c778d4f3d0b1210c4a5a6d1e0c247813eafb673f

  • SSDEEP

    3072:sr85CtsXhq1Oc0hM+lmsolAIrRuw+mqv9j1MWLQ41VzBdCOI/L9+bXH:k9tsXRa+lDAAHhB0OIzkb3

  Score

  10^/10

  neshtaxwormdiscoveryexecutionpersistenceratspywarestealertrojan

  • Detect Neshta payload

  • Detect Xworm Payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2