General
- Target 364be73be12ad3e8d754ef00f5210ba22601cd5750387a44ea6cb3e2fe7b7ea7.exe
- Size 22.3MB
- Sample221106-bh891saec2
- SHA256 364be73be12ad3e8d754ef00f5210ba22601cd5750387a44ea6cb3e2fe7b7ea7
Score
10/10
Malware Config
Targets
-
- Target 364be73be12ad3e8d754ef00f5210ba22601cd5750387a44ea6cb3e2fe7b7ea7.exe
- Size 22.3MB
- SHA256 364be73be12ad3e8d754ef00f5210ba22601cd5750387a44ea6cb3e2fe7b7ea7
Score10/10BlackGuard
Infostealer first seen in Late 2021.
Detect Neshta payload
Modifies system executable filetype association
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
Downloads MZ/PE file
Executes dropped EXE
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Drops file in System32 directory