Overview

overview

10

Static

static

10

62d2ffb7db...4a.exe

windows7_x64

10

62d2ffb7db...4a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    62d2ffb7db9863048a07bddb5a61b5e9146a779152fefa5a5e5e5151db9b1a4a

  • Size

    106KB

  • Sample

    220621-vmbdbsaed6

  • MD5

    301ea7a68e57be3232fb9620bf6a1000

  • SHA1

    d634b8bbb34370a50e1658833662736724d5e40b

  • SHA256

    62d2ffb7db9863048a07bddb5a61b5e9146a779152fefa5a5e5e5151db9b1a4a

  • SHA512

    5509575bf1ad2424ae0e3ca7737fde48f0aad807c2ef320d50deb62990ba85a50f418ceb74a6f0add2c6dbcad7e82d9ce4db3a4922c0435aa6d0c2f552c7de5b

Score
10/10
neshtaxtremeratpersistenceratspywarestealer

Malware Config

Targets

    • Target

      62d2ffb7db9863048a07bddb5a61b5e9146a779152fefa5a5e5e5151db9b1a4a

    • Size

      106KB

    • MD5

      301ea7a68e57be3232fb9620bf6a1000

    • SHA1

      d634b8bbb34370a50e1658833662736724d5e40b

    • SHA256

      62d2ffb7db9863048a07bddb5a61b5e9146a779152fefa5a5e5e5151db9b1a4a

    • SHA512

      5509575bf1ad2424ae0e3ca7737fde48f0aad807c2ef320d50deb62990ba85a50f418ceb74a6f0add2c6dbcad7e82d9ce4db3a4922c0435aa6d0c2f552c7de5b

    Score
    10/10
    neshtaxtremeratpersistenceratspywarestealer

    • Detect XtremeRAT Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks