Overview

overview

10

Static

static

10

7dd76cc3eb...74.exe

windows7_x64

10

7dd76cc3eb...74.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7dd76cc3eb3ba4a1fb5ace98d96d040b2b0091f47ee8a9fc95fb348601930b74

  • Size

    899KB

  • Sample

    220524-bns5zsbdh5

  • MD5

    6a5fab16777dcb3aac59b58251fab329

  • SHA1

    3d416c30c20cc6f88977bb4938884fc7d6f6b25d

  • SHA256

    7dd76cc3eb3ba4a1fb5ace98d96d040b2b0091f47ee8a9fc95fb348601930b74

  • SHA512

    405f264f78f96fbe6fc2c7d1bc70f68f9d070512769454d7d6755db4bfe9a80c278f6aa4a0cfc65b76116fc1c11172c445bb3a6f94a5feb47bbb66f561800b89

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      7dd76cc3eb3ba4a1fb5ace98d96d040b2b0091f47ee8a9fc95fb348601930b74

    • Size

      899KB

    • MD5

      6a5fab16777dcb3aac59b58251fab329

    • SHA1

      3d416c30c20cc6f88977bb4938884fc7d6f6b25d

    • SHA256

      7dd76cc3eb3ba4a1fb5ace98d96d040b2b0091f47ee8a9fc95fb348601930b74

    • SHA512

      405f264f78f96fbe6fc2c7d1bc70f68f9d070512769454d7d6755db4bfe9a80c278f6aa4a0cfc65b76116fc1c11172c445bb3a6f94a5feb47bbb66f561800b89

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks