Overview

overview

10

Static

static

10

280ce73de4...22.exe

windows7-x64

10

280ce73de4...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    280ce73de4bc0ba7a4264c5a070db290972bdb05bee0fa671a57e9d967290322

  • Size

    145KB

  • Sample

    221118-2dcncseg8s

  • MD5

    4ae8f02452cdbfeef9e8dd461c881b90

  • SHA1

    14b6cb95307d3be8afbd615e7697e0e07b3fcaae

  • SHA256

    280ce73de4bc0ba7a4264c5a070db290972bdb05bee0fa671a57e9d967290322

  • SHA512

    d33df5ae3b098ebbe24428193d4059d64848821cdc375cc801108ad952cad016981df8db8ac6bc35784c341a504e4e44d6ded6d020b986add07819ba548febcc

  • SSDEEP

    3072:sr8lCXGaJZIJM5jbnv+Ojof2flCDTOXgMwQcj3zH2:kxXGa0yBzv+OjYWCDqwQcT6

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      280ce73de4bc0ba7a4264c5a070db290972bdb05bee0fa671a57e9d967290322

    • Size

      145KB

    • MD5

      4ae8f02452cdbfeef9e8dd461c881b90

    • SHA1

      14b6cb95307d3be8afbd615e7697e0e07b3fcaae

    • SHA256

      280ce73de4bc0ba7a4264c5a070db290972bdb05bee0fa671a57e9d967290322

    • SHA512

      d33df5ae3b098ebbe24428193d4059d64848821cdc375cc801108ad952cad016981df8db8ac6bc35784c341a504e4e44d6ded6d020b986add07819ba548febcc

    • SSDEEP

      3072:sr8lCXGaJZIJM5jbnv+Ojof2flCDTOXgMwQcj3zH2:kxXGa0yBzv+OjYWCDqwQcT6

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks