Overview

overview

10

Static

static

10

15e99512d4...c9.exe

windows7_x64

10

15e99512d4...c9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15e99512d4386db3263859caf7b0df2aef1eb8bd8057f36e1ad2ee7088f8f8c9

  • Size

    231KB

  • Sample

    220524-bpp5qaehcm

  • MD5

    73ed0fc0f030aa35179544aae38f1981

  • SHA1

    0a89ec3b91049b60a7e9deacef8860b010fa4782

  • SHA256

    15e99512d4386db3263859caf7b0df2aef1eb8bd8057f36e1ad2ee7088f8f8c9

  • SHA512

    f07fa19e5ae9df39c3cabaedc0142d7eec377b155fa4ef62a45ac5ee430f803388bcc43278e180e409a54888ff2744c041cad2524776f304859fa05cdeba4b73

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      15e99512d4386db3263859caf7b0df2aef1eb8bd8057f36e1ad2ee7088f8f8c9

    • Size

      231KB

    • MD5

      73ed0fc0f030aa35179544aae38f1981

    • SHA1

      0a89ec3b91049b60a7e9deacef8860b010fa4782

    • SHA256

      15e99512d4386db3263859caf7b0df2aef1eb8bd8057f36e1ad2ee7088f8f8c9

    • SHA512

      f07fa19e5ae9df39c3cabaedc0142d7eec377b155fa4ef62a45ac5ee430f803388bcc43278e180e409a54888ff2744c041cad2524776f304859fa05cdeba4b73

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks