neshta | 6b3170b2e0ff449edf080fb5f278d963ec69f68afaad7f31d688df89e6a43d1c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

6b3170b2e0...1c.exe

windows7-x64

6b3170b2e0...1c.exe

windows10-2004-x64

Sharing

General

Target

6b3170b2e0ff449edf080fb5f278d963ec69f68afaad7f31d688df89e6a43d1c
Size

273KB
Sample

221025-dnfwrsbde2
MD5

8c7fadc8cfa7c3843e1476955b3cefb2
SHA1

acdea4a7ce0985ad0f40e63f76b20c249e7bb2e9
SHA256

6b3170b2e0ff449edf080fb5f278d963ec69f68afaad7f31d688df89e6a43d1c
SHA512

039698f0415e4dfe9e3e9b0a4328df6e6c7b08880f8d8c775021852ce6b7d91597695df12d6c7a8f8c04c2e1efa0cb5590a3a127d63a61affbde25e1f06b742a
SSDEEP

3072:sr85C9j0O8Jy99J5RqG7R6kE9NFr2wDDJ3Tq14EY6T5180KW4txEeXp9/:k99Ag3699X5X5AUQ80dPmr/

Score

10^/10

neshta smokeloader backdoor persistence spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

6b3170b2e0ff449edf080fb5f278d963ec69f68afaad7f31d688df89e6a43d1c.exe

Resource

win7-20220901-en

neshta smokeloader backdoor persistence spyware stealer trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

6b3170b2e0ff449edf080fb5f278d963ec69f68afaad7f31d688df89e6a43d1c.exe

Resource

win10v2004-20220812-en

neshta smokeloader backdoor persistence spyware trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  6b3170b2e0ff449edf080fb5f278d963ec69f68afaad7f31d688df89e6a43d1c
- Size
  
  273KB
- MD5
  
  8c7fadc8cfa7c3843e1476955b3cefb2
- SHA1
  
  acdea4a7ce0985ad0f40e63f76b20c249e7bb2e9
- SHA256
  
  6b3170b2e0ff449edf080fb5f278d963ec69f68afaad7f31d688df89e6a43d1c
- SHA512
  
  039698f0415e4dfe9e3e9b0a4328df6e6c7b08880f8d8c775021852ce6b7d91597695df12d6c7a8f8c04c2e1efa0cb5590a3a127d63a61affbde25e1f06b742a
- SSDEEP
  
  3072:sr85C9j0O8Jy99J5RqG7R6kE9NFr2wDDJ3Tq14EY6T5180KW4txEeXp9/:k99Ag3699X5X5AUQ80dPmr/
Score

10^/10

neshta smokeloader backdoor persistence spyware stealer trojan
- Detects Smokeloader packer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtasmokeloaderbackdoorpersistencespywarestealertrojan

behavioral2

neshtasmokeloaderbackdoorpersistencespywaretrojan

© 2018-2025

Terms | Privacy