neshta | e9ba8163308c746aa5ae1c9f89005238733f47707a91315b54a40e3ef74d47ec | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

e9ba816330...ec.exe

windows7-x64

e9ba816330...ec.exe

windows10-2004-x64

Sharing

General

Target

e9ba8163308c746aa5ae1c9f89005238733f47707a91315b54a40e3ef74d47ec
Size

352KB
Sample

221003-yf4cbadae2
MD5

6aeae49808cfb5549f187cf28883cb20
SHA1

cc0452cdcb791c96f18f0ae1e6c64833ecff61e9
SHA256

e9ba8163308c746aa5ae1c9f89005238733f47707a91315b54a40e3ef74d47ec
SHA512

0e6a4959dccc57649180079f4a400caf8881c9b852a91e37be6de38eec03e1f356ca955d6b8b4f1f0e0ad4b632fb3da5bf13e08de8ca34922006edbbf4d124c6
SSDEEP

6144:k9CcMDcknswQM3XM3llUlA+QCD8PB3SAUXh6BLREoSdLfsztUB:xceXsw9X6ll4A+fD8xSheNEoSdLaUB

Score

10^/10

neshta evasion persistence spyware stealer upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

e9ba8163308c746aa5ae1c9f89005238733f47707a91315b54a40e3ef74d47ec.exe

Resource

win7-20220812-en

neshta evasion persistence spyware stealer upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

e9ba8163308c746aa5ae1c9f89005238733f47707a91315b54a40e3ef74d47ec.exe

Resource

win10v2004-20220812-en

neshta evasion persistence spyware stealer upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  e9ba8163308c746aa5ae1c9f89005238733f47707a91315b54a40e3ef74d47ec
- Size
  
  352KB
- MD5
  
  6aeae49808cfb5549f187cf28883cb20
- SHA1
  
  cc0452cdcb791c96f18f0ae1e6c64833ecff61e9
- SHA256
  
  e9ba8163308c746aa5ae1c9f89005238733f47707a91315b54a40e3ef74d47ec
- SHA512
  
  0e6a4959dccc57649180079f4a400caf8881c9b852a91e37be6de38eec03e1f356ca955d6b8b4f1f0e0ad4b632fb3da5bf13e08de8ca34922006edbbf4d124c6
- SSDEEP
  
  6144:k9CcMDcknswQM3XM3llUlA+QCD8PB3SAUXh6BLREoSdLfsztUB:xceXsw9X6ll4A+fD8xSheNEoSdLaUB
Score

10^/10

neshta evasion persistence spyware stealer upx
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtaevasionpersistencespywarestealerupx

behavioral2

neshtaevasionpersistencespywarestealerupx

© 2018-2025

Terms | Privacy