General

  • Target

    0a31021b52d07ba0d233bf5a2f7f84cb

  • Size

    3.6MB

  • Sample

    220906-1e3eqsffhl

  • MD5

    0a31021b52d07ba0d233bf5a2f7f84cb

  • SHA1

    66432f7a67d2bcb472bbf8ab3819bbd5bbb42328

  • SHA256

    c077e42c0c44d125d58bc2aeeffc81f3b4fbeebec5c7ab809b31f4e06b46a2c2

  • SHA512

    6802a18a6a1e97207dc635069913f44bc57c56aae3820f95334499a7bad85ba7aecf9d21d153286ea07646696661eda3ad14097b0119de995124bad4766273af

  • SSDEEP

    98304:VT4FZE1qYlkQNmqouCG4YMIyzzPcva1uElvi4VyU0CaTkuO3jJiXbHHYI0iKSfxf:VsniYy9Mm4ybG3j00hi/pf

Malware Config

Targets

    • Target

      0a31021b52d07ba0d233bf5a2f7f84cb

    • Size

      3.6MB

    • MD5

      0a31021b52d07ba0d233bf5a2f7f84cb

    • SHA1

      66432f7a67d2bcb472bbf8ab3819bbd5bbb42328

    • SHA256

      c077e42c0c44d125d58bc2aeeffc81f3b4fbeebec5c7ab809b31f4e06b46a2c2

    • SHA512

      6802a18a6a1e97207dc635069913f44bc57c56aae3820f95334499a7bad85ba7aecf9d21d153286ea07646696661eda3ad14097b0119de995124bad4766273af

    • SSDEEP

      98304:VT4FZE1qYlkQNmqouCG4YMIyzzPcva1uElvi4VyU0CaTkuO3jJiXbHHYI0iKSfxf:VsniYy9Mm4ybG3j00hi/pf

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks