Extracted

• • Target

    ATRTool_2.0.exe

  • Size

    2.1MB

  • MD5

    3ae9004eaa14b935532ca38e56c364e0

  • SHA1

    022afbf6dc5577509e031f30fe570169710f056b

  • SHA256

    595eb49460b7eb4f393af28a335dcaf98317faad04a92e49e9eceaa1f7379f40

  • SHA512

    694c8403c53f40eeec2efef61f98cdbd76c1c187d3abcff550cd67aa8f96f375b81260a655d842be2cc9bc519281d97cafa790ea3524aa5ad48d3c298609aba8

  • SSDEEP

    49152:dnsHyjtk2MYC5GDgHyjtk2MYC5GD/qnUiBqnUUpQln:dnsmtk2aVmtk2aApOn

  Score

  10^/10

  neshtaxredbackdoordiscoverypersistencespywarestealer

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2