Overview

overview

10

Static

static

10

tmp/NHY9Wg...9Y.exe

windows7_x64

10

tmp/NHY9Wg...9Y.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp/NHY9WgdS1Q8pZ9Y.exe

  • Size

    1.3MB

  • Sample

    211214-q68eysfgg2

  • MD5

    6f1e08f3aeec64cedb74a5bb7ff22392

  • SHA1

    961cc902df5b2ebc015dd848e7da4f7992eb6b54

  • SHA256

    f78ac503e0942a1bafd27fc9464ab605eac94184d9da91a0385beb8debef65e4

  • SHA512

    69d62f15c6a8aae56184be5cb0d2c115af5688d39640b881c9f369b7b73cbf145f372da2a93427853489646a42cea38df84a7e6edb94ae845a5c873e9ba43934

Score
10/10
neshtaxloaderb62nloaderpersistenceratspywarestealer

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b62n

C2

http://www.multidetoxhepatico.com/b62n/

Decoy

childzplanet.com

nine8culture.com

yourfoodmenu.com

nxhxyzjy.com

nobelies.com

baetsupreme.net

indiadiscountedfares.com

iconnect-design.com

durston.store

sweetcreationsbyjp.com

ktieman.com

getvirtualaddress.com

cryptopoly-figures.com

minismi2.com

ricemoment.com

regionalhomescommercial.com

onelike.biz

d22.group

kwissleapp.com

cindyrandband.com

Targets

    • Target

      tmp/NHY9WgdS1Q8pZ9Y.exe

    • Size

      1.3MB

    • MD5

      6f1e08f3aeec64cedb74a5bb7ff22392

    • SHA1

      961cc902df5b2ebc015dd848e7da4f7992eb6b54

    • SHA256

      f78ac503e0942a1bafd27fc9464ab605eac94184d9da91a0385beb8debef65e4

    • SHA512

      69d62f15c6a8aae56184be5cb0d2c115af5688d39640b881c9f369b7b73cbf145f372da2a93427853489646a42cea38df84a7e6edb94ae845a5c873e9ba43934

    Score
    10/10
    neshtaxloaderb62nloaderpersistenceratspywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks