General

  • Target

    tmp

  • Size

    1.4MB

  • Sample

    221002-sma2fsdefl

  • MD5

    426aa8067b0fd14d967b228454b1bf83

  • SHA1

    2a935c83f72fa96daed63c9bd2baf4686025d9bb

  • SHA256

    ce87832b753df5480849c61df4e05bfd2bfbd72af88ad52093a54555f3d96f0e

  • SHA512

    91b50bb677375a1211934331253a4b7d5191dd1527f7c42a8010382f545726e5ff3cfc818d47b8fe95cdc35cfe0dab82e9a4dafd181ba909933022408ab8915c

  • SSDEEP

    24576:zCm8uPdJcWyHkvcIRqBlp9tzTsV78KfXbITPoLg6PXDA9xYjGQ:qWbDvcIIr1TsdJfXbIcLVPzA9KiQ

Malware Config

Targets

    • Target

      tmp

    • Size

      1.4MB

    • MD5

      426aa8067b0fd14d967b228454b1bf83

    • SHA1

      2a935c83f72fa96daed63c9bd2baf4686025d9bb

    • SHA256

      ce87832b753df5480849c61df4e05bfd2bfbd72af88ad52093a54555f3d96f0e

    • SHA512

      91b50bb677375a1211934331253a4b7d5191dd1527f7c42a8010382f545726e5ff3cfc818d47b8fe95cdc35cfe0dab82e9a4dafd181ba909933022408ab8915c

    • SSDEEP

      24576:zCm8uPdJcWyHkvcIRqBlp9tzTsV78KfXbITPoLg6PXDA9xYjGQ:qWbDvcIIr1TsdJfXbIcLVPzA9KiQ

    • Detect Neshta payload

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

MITRE ATT&CK Enterprise v6

Tasks