Overview

overview

10

Static

static

10

24133e1fbb...e2.exe

windows7-x64

10

24133e1fbb...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24133e1fbb8d857d4c4d3dba19ca3f776a8bb88c5a05f1045c6d86a0dc1fc5e2

  • Size

    408KB

  • Sample

    221030-3c3ntsfdfr

  • MD5

    90fc522ce014d52feb8063e844f70cc0

  • SHA1

    fc29cc26bd22a841e1e88afa56f8a529ce11c40e

  • SHA256

    24133e1fbb8d857d4c4d3dba19ca3f776a8bb88c5a05f1045c6d86a0dc1fc5e2

  • SHA512

    b3b30bf450ad39bbf7c7601055efeb166e150d24213d114ac81d631efe5c021d60f666038ff0821b644fd6f45a52ecf8369ee65f5eeb1853c1766ff4aabb5cb7

  • SSDEEP

    6144:k9kQc0WTIVR/SHdCzx5xoX3/Di6R/SHdCzxkz5s2XwwBZt+:jQc0WUo+03/DipBqwBZt+

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      24133e1fbb8d857d4c4d3dba19ca3f776a8bb88c5a05f1045c6d86a0dc1fc5e2

    • Size

      408KB

    • MD5

      90fc522ce014d52feb8063e844f70cc0

    • SHA1

      fc29cc26bd22a841e1e88afa56f8a529ce11c40e

    • SHA256

      24133e1fbb8d857d4c4d3dba19ca3f776a8bb88c5a05f1045c6d86a0dc1fc5e2

    • SHA512

      b3b30bf450ad39bbf7c7601055efeb166e150d24213d114ac81d631efe5c021d60f666038ff0821b644fd6f45a52ecf8369ee65f5eeb1853c1766ff4aabb5cb7

    • SSDEEP

      6144:k9kQc0WTIVR/SHdCzx5xoX3/Di6R/SHdCzxkz5s2XwwBZt+:jQc0WUo+03/DipBqwBZt+

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks