Overview

overview

10

Static

static

8153c59d6e...6e.exe

windows7-x64

10

8153c59d6e...6e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8153c59d6e644a85c2085fcdaa81a316f97126c12fe25e0b6690f7910144fd6e

  • Size

    4.4MB

  • Sample

    221002-yz2b3aaecn

  • MD5

    6fb28d9c17efe7c2e8b8c27339b6af0c

  • SHA1

    43bf5981339ad526b8f683241a7bcba451b7c338

  • SHA256

    8153c59d6e644a85c2085fcdaa81a316f97126c12fe25e0b6690f7910144fd6e

  • SHA512

    8a5342de1a39cf46d22061caf2942d541269bcfa4d3dd02a6d4191e990bee6f3d8f7dc4bfe3e772b4d35f2b939fa0d9355ebccab43ec4a80917d09caf1ad7668

  • SSDEEP

    98304:IF2UaWtXvn6aLD7A8J3IZ55gNjv1H4H2sn:pdWPFZ3IZ55gNj9H4H1

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      8153c59d6e644a85c2085fcdaa81a316f97126c12fe25e0b6690f7910144fd6e

    • Size

      4.4MB

    • MD5

      6fb28d9c17efe7c2e8b8c27339b6af0c

    • SHA1

      43bf5981339ad526b8f683241a7bcba451b7c338

    • SHA256

      8153c59d6e644a85c2085fcdaa81a316f97126c12fe25e0b6690f7910144fd6e

    • SHA512

      8a5342de1a39cf46d22061caf2942d541269bcfa4d3dd02a6d4191e990bee6f3d8f7dc4bfe3e772b4d35f2b939fa0d9355ebccab43ec4a80917d09caf1ad7668

    • SSDEEP

      98304:IF2UaWtXvn6aLD7A8J3IZ55gNjv1H4H2sn:pdWPFZ3IZ55gNj9H4H1

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks