Overview

overview

10

Static

static

10

f9cab18202...62.exe

windows7_x64

10

f9cab18202...62.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9cab18202495f4e981382a2b186981b57b744d55eb7e2e1e0d7242e683c0f62

  • Size

    1.5MB

  • Sample

    220206-jcd6pagdg8

  • MD5

    831b6bebff1bd1e5ab47734fe3ef58d9

  • SHA1

    f586d8453da283b69218c24f3bcd1babcee9f0ea

  • SHA256

    f9cab18202495f4e981382a2b186981b57b744d55eb7e2e1e0d7242e683c0f62

  • SHA512

    a8d91147d45a07bbead483db4ecb72f33fc6a0735644dba066d002f893720b6fbe7a321aac9f89e31c2a36d96a8cd66bc4a71ee4c64ccbc48f2f3b9abcb70986

Score
10/10
neshtaevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      f9cab18202495f4e981382a2b186981b57b744d55eb7e2e1e0d7242e683c0f62

    • Size

      1.5MB

    • MD5

      831b6bebff1bd1e5ab47734fe3ef58d9

    • SHA1

      f586d8453da283b69218c24f3bcd1babcee9f0ea

    • SHA256

      f9cab18202495f4e981382a2b186981b57b744d55eb7e2e1e0d7242e683c0f62

    • SHA512

      a8d91147d45a07bbead483db4ecb72f33fc6a0735644dba066d002f893720b6fbe7a321aac9f89e31c2a36d96a8cd66bc4a71ee4c64ccbc48f2f3b9abcb70986

    Score
    10/10
    neshtaevasionpersistencespywarestealertrojan

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks