Overview

overview

10

Static

static

d56bce3059...b4.exe

windows7-x64

10

d56bce3059...b4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d56bce305902d51f4cf65c3810ea4045b8d8c246fab50a1921cbae3114ee16b4

  • Size

    698KB

  • Sample

    221020-px46hadher

  • MD5

    96f5106d34b4cf1e5ec042c146ce86cc

  • SHA1

    6f6742a26ef7a404b6896990351de5729b887d12

  • SHA256

    d56bce305902d51f4cf65c3810ea4045b8d8c246fab50a1921cbae3114ee16b4

  • SHA512

    0d36cda4b55a830dc85651e6ef973936c3892eee308dca747460897b75cfbeb7ab42c0f57fd9aca34730a19372b04afe3c693f0aa3479a153dd80ab40dffef4f

  • SSDEEP

    12288:hQRIn3vyyfAEabBDRSlb6XU0xTSjhm8tXAaqyoO0WWfnrPJmLtwQ:hxnKUclRS8RTSVfBAaqyoOTWfnrPdQ

Score
10/10
neshtapersistencespywarestealerupx

Malware Config

Targets

    • Target

      d56bce305902d51f4cf65c3810ea4045b8d8c246fab50a1921cbae3114ee16b4

    • Size

      698KB

    • MD5

      96f5106d34b4cf1e5ec042c146ce86cc

    • SHA1

      6f6742a26ef7a404b6896990351de5729b887d12

    • SHA256

      d56bce305902d51f4cf65c3810ea4045b8d8c246fab50a1921cbae3114ee16b4

    • SHA512

      0d36cda4b55a830dc85651e6ef973936c3892eee308dca747460897b75cfbeb7ab42c0f57fd9aca34730a19372b04afe3c693f0aa3479a153dd80ab40dffef4f

    • SSDEEP

      12288:hQRIn3vyyfAEabBDRSlb6XU0xTSjhm8tXAaqyoO0WWfnrPJmLtwQ:hxnKUclRS8RTSVfBAaqyoOTWfnrPdQ

    Score
    10/10
    neshtapersistencespywarestealerupx

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks