Overview

overview

10

Static

static

AternosCrasher.exe

windows7-x64

8

AternosCrasher.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AternosCrasher.exe

  • Size

    52KB

  • Sample

    220827-s2l29scfel

  • MD5

    ef51ae63557c39a09236dd2010ba4a1d

  • SHA1

    73f8403f3d42e036f6ec0b6f46a0f98df13a6345

  • SHA256

    d7a0c0b628e8a235974d5f8ccd7f4e02357f6633ef6826a0ce4942e7de4d6bb4

  • SHA512

    8f54722632bae05ca036d7a88d1392140f50ab419ad560502847054f74930db587830f1f6e00f4dc086a03168c65859f9ad7159f22c915dd2d0a1dc380b5ec80

  • SSDEEP

    768:5qWNXorm5YPjO/YRseR7CBN5inx2IGAW3/Pc/CNAkt7Uigj4zEIAV88lh9:5qWduPjUpsHW3/PbBN1gj4wHV88X9

Score
10/10
neshtaevasionpersistencespywarestealer

Malware Config

Targets

    • Target

      AternosCrasher.exe

    • Size

      52KB

    • MD5

      ef51ae63557c39a09236dd2010ba4a1d

    • SHA1

      73f8403f3d42e036f6ec0b6f46a0f98df13a6345

    • SHA256

      d7a0c0b628e8a235974d5f8ccd7f4e02357f6633ef6826a0ce4942e7de4d6bb4

    • SHA512

      8f54722632bae05ca036d7a88d1392140f50ab419ad560502847054f74930db587830f1f6e00f4dc086a03168c65859f9ad7159f22c915dd2d0a1dc380b5ec80

    • SSDEEP

      768:5qWNXorm5YPjO/YRseR7CBN5inx2IGAW3/Pc/CNAkt7Uigj4zEIAV88lh9:5qWduPjUpsHW3/PbBN1gj4wHV88X9

    Score
    10/10
    evasionpersistenceneshtaspywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks