Overview

overview

10

Static

static

Dekont_202...df.exe

windows7-x64

9

Dekont_202...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Dekont_20220926155607 pdf.exe

  • Size

    11KB

  • Sample

    220926-kcz9laaag7

  • MD5

    98ec95d07881fe20943c648fc17a4884

  • SHA1

    4caeeacf2e4dcac911f64a20b00388f96e9adc7e

  • SHA256

    56fd163108e6e2a9e2f7cfd15898f61d5b8d435ed839d1e29b70c040998eedcf

  • SHA512

    ac4e2b370b3880cdc6a67f9978c4f82fe3686d9ccb6bfc580a233721d7befc8709ddb056c76d8db369bdf7f2c49f6a0ab65e3e3c75f041ebde18a7761e1f7f48

  • SSDEEP

    192:yMZ3k3osS0Otg03xoVjn9GprrrrrrrrrrrrrrrrrrrreKp:yMZ04s7OSaxoVwprrrrrrrrrrrrrrrrh

Score
10/10
neshtadiscoverypersistencespyware

Malware Config

Targets

    • Target

      Dekont_20220926155607 pdf.exe

    • Size

      11KB

    • MD5

      98ec95d07881fe20943c648fc17a4884

    • SHA1

      4caeeacf2e4dcac911f64a20b00388f96e9adc7e

    • SHA256

      56fd163108e6e2a9e2f7cfd15898f61d5b8d435ed839d1e29b70c040998eedcf

    • SHA512

      ac4e2b370b3880cdc6a67f9978c4f82fe3686d9ccb6bfc580a233721d7befc8709ddb056c76d8db369bdf7f2c49f6a0ab65e3e3c75f041ebde18a7761e1f7f48

    • SSDEEP

      192:yMZ3k3osS0Otg03xoVjn9GprrrrrrrrrrrrrrrrrrrreKp:yMZ04s7OSaxoVwprrrrrrrrrrrrrrrrh

    Score
    10/10
    discoveryneshtapersistencespyware

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks