Extracted

• • Target
    https://www.mediafire.com/file/axker9aby7cjy29/CrackTool_2026.zip/file

  Score

  10^/10

  defense_evasiondiscoveryevasionneshtaxwormpersistenceransomwareratspywarestealertrojanupx

  • Detect Neshta payload

  • Detect Xworm Payload

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies security service

    defense_evasion

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1