Overview

overview

10

Static

static

10

3edf392acb...d5.exe

windows7_x64

10

3edf392acb...d5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3edf392acb5b5b3679cfbbb3a9cdf89fdc86f77af84ca1c2531eed58ec1bb3d5

  • Size

    2.5MB

  • Sample

    220524-dxqsbshdam

  • MD5

    629d962a1be2a37941c6491310801aa9

  • SHA1

    f21315141098e7b6a28f01eb7403b06c18861cea

  • SHA256

    3edf392acb5b5b3679cfbbb3a9cdf89fdc86f77af84ca1c2531eed58ec1bb3d5

  • SHA512

    ae9cc7887161a68620ba38ab40c85b17aaf589c68d93c418a01bfe1359db4ef6e78bafd1b694646f3687ed47136523f4fb6118af922fc9de50422c12d1765bda

Score
10/10
neshtaagilenetpersistencespywarestealer

Malware Config

Targets

    • Target

      3edf392acb5b5b3679cfbbb3a9cdf89fdc86f77af84ca1c2531eed58ec1bb3d5

    • Size

      2.5MB

    • MD5

      629d962a1be2a37941c6491310801aa9

    • SHA1

      f21315141098e7b6a28f01eb7403b06c18861cea

    • SHA256

      3edf392acb5b5b3679cfbbb3a9cdf89fdc86f77af84ca1c2531eed58ec1bb3d5

    • SHA512

      ae9cc7887161a68620ba38ab40c85b17aaf589c68d93c418a01bfe1359db4ef6e78bafd1b694646f3687ed47136523f4fb6118af922fc9de50422c12d1765bda

    Score
    10/10
    neshtaagilenetpersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks