Overview

overview

10

Static

static

10

2dea2f6306...35.exe

windows7_x64

10

2dea2f6306...35.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2dea2f63062205763ad2ca0f1eb27f5a6b336d70b809d56a2d4c6bb7bb9abf35

  • Size

    410KB

  • Sample

    220524-dqk89shaej

  • MD5

    0a207b0099aa0532b2231878a209ad14

  • SHA1

    e69893a5c667eb2645805f8aabd2443ef459c8fd

  • SHA256

    2dea2f63062205763ad2ca0f1eb27f5a6b336d70b809d56a2d4c6bb7bb9abf35

  • SHA512

    6f6daf2a96b7dabb09bab0d9bdba7557e39ad47ff2bc5c15fc054925f6c376e446d6cd9fda2e1e6665bdfaa6de0038bf22a91fa46fb56c6a7107c7ae70c460ff

Score
10/10
neshtapersistencespyware

Malware Config

Targets

    • Target

      2dea2f63062205763ad2ca0f1eb27f5a6b336d70b809d56a2d4c6bb7bb9abf35

    • Size

      410KB

    • MD5

      0a207b0099aa0532b2231878a209ad14

    • SHA1

      e69893a5c667eb2645805f8aabd2443ef459c8fd

    • SHA256

      2dea2f63062205763ad2ca0f1eb27f5a6b336d70b809d56a2d4c6bb7bb9abf35

    • SHA512

      6f6daf2a96b7dabb09bab0d9bdba7557e39ad47ff2bc5c15fc054925f6c376e446d6cd9fda2e1e6665bdfaa6de0038bf22a91fa46fb56c6a7107c7ae70c460ff

    Score
    10/10
    neshtapersistencespyware

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks