Overview

overview

10

Static

static

10

16be47273b...4c.exe

windows7_x64

10

16be47273b...4c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16be47273b419401e61240488ddf51f7d01d374800bc1c353a8d6694f5ff3a4c

  • Size

    3.0MB

  • Sample

    220608-3d2sxsagf9

  • MD5

    41e0e08483d1296e80f712d4f0fff7c1

  • SHA1

    7965b487f07f16f2740fa278d573b395377f6500

  • SHA256

    16be47273b419401e61240488ddf51f7d01d374800bc1c353a8d6694f5ff3a4c

  • SHA512

    0480226e5e16c3c91f73efa86bb3c4a6fc6b13a56cd11f276edce3e9198fd58ce08ea962e88ae28e3c40719261dd0225ab2d66c62645512f93834e76ae6b96c2

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      16be47273b419401e61240488ddf51f7d01d374800bc1c353a8d6694f5ff3a4c

    • Size

      3.0MB

    • MD5

      41e0e08483d1296e80f712d4f0fff7c1

    • SHA1

      7965b487f07f16f2740fa278d573b395377f6500

    • SHA256

      16be47273b419401e61240488ddf51f7d01d374800bc1c353a8d6694f5ff3a4c

    • SHA512

      0480226e5e16c3c91f73efa86bb3c4a6fc6b13a56cd11f276edce3e9198fd58ce08ea962e88ae28e3c40719261dd0225ab2d66c62645512f93834e76ae6b96c2

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks