Overview

overview

10

Static

static

10

doc-file#98765678.exe

windows7-x64

10

doc-file#98765678.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    doc-file#98765678.exe

  • Size

    865KB

  • Sample

    220926-qmsv6aahc9

  • MD5

    5d31ff727ddebc94f37cff188c0fc3e7

  • SHA1

    64b79513675b4421a1d6c36502a07d9395d3aa24

  • SHA256

    72a9187d68249e63f4562b466013c4a77b622621a229249874572e667fb80b2e

  • SHA512

    0bd7cd4e3cd6ec25908c75ead3a8e6ebe46258115b7a110f449b096eb009233a89474e8cde4eb281bf11c1e1cd85f4af643c6a4928e574fc2c25bd343e4f16e6

  • SSDEEP

    12288:zAtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozEJ1888888888888W88888888W:zANzCtUpQ9WWPBSSRMTEpMNJj

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      doc-file#98765678.exe

    • Size

      865KB

    • MD5

      5d31ff727ddebc94f37cff188c0fc3e7

    • SHA1

      64b79513675b4421a1d6c36502a07d9395d3aa24

    • SHA256

      72a9187d68249e63f4562b466013c4a77b622621a229249874572e667fb80b2e

    • SHA512

      0bd7cd4e3cd6ec25908c75ead3a8e6ebe46258115b7a110f449b096eb009233a89474e8cde4eb281bf11c1e1cd85f4af643c6a4928e574fc2c25bd343e4f16e6

    • SSDEEP

      12288:zAtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozEJ1888888888888W88888888W:zANzCtUpQ9WWPBSSRMTEpMNJj

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks