Overview

overview

10

Static

static

10

doc-file#98765678.exe

windows7-x64

10

doc-file#98765678.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment-#9000000.ace

  • Size

    315KB

  • Sample

    220926-qmsv6acagp

  • MD5

    5bcba285a1afa444aa0cece39c88c178

  • SHA1

    185aad09818fdfa0dbc7b3cab55cac0ec2628535

  • SHA256

    647a6859da705b75801e74fdbb713c7f219b7b024bd0a08681003225bbb31cf8

  • SHA512

    68e750b3aa7fc6113007dbbfc1519485609c727633fff7557a3143d634e9364cbd0b4becdf21c6834306372eaf1db781d1613cbad7cc4ea7afb0b7266d1bcfc8

  • SSDEEP

    6144:v3uZgf060ydrLnzPU1dUxL2U8v3l0nQx5TN8ECvRkmL0SnDSnXpyDCt44AICc:GIbdnzU7Udf8sQx5lC5kUyZ7JAICc

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      doc-file#98765678.exe

    • Size

      865KB

    • MD5

      5d31ff727ddebc94f37cff188c0fc3e7

    • SHA1

      64b79513675b4421a1d6c36502a07d9395d3aa24

    • SHA256

      72a9187d68249e63f4562b466013c4a77b622621a229249874572e667fb80b2e

    • SHA512

      0bd7cd4e3cd6ec25908c75ead3a8e6ebe46258115b7a110f449b096eb009233a89474e8cde4eb281bf11c1e1cd85f4af643c6a4928e574fc2c25bd343e4f16e6

    • SSDEEP

      12288:zAtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozEJ1888888888888W88888888W:zANzCtUpQ9WWPBSSRMTEpMNJj

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks