Overview

overview

10

Static

static

10

d8d8c25f5d...63.exe

windows7-x64

10

d8d8c25f5d...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8d8c25f5deb919119bec928bde489942adbfe9cd3d831969ef5d35417ad7d63

  • Size

    639KB

  • Sample

    221119-3b5rssae2z

  • MD5

    4252ada6d090e54ef59e088106f20340

  • SHA1

    15093e4433a995e25c7f45aab38744a73864a15c

  • SHA256

    d8d8c25f5deb919119bec928bde489942adbfe9cd3d831969ef5d35417ad7d63

  • SHA512

    4a1d331571654123bf26cca978b18585a9b427f79050996d04042567ff62149b2e3a4dbb2084cec516ae78e02d612fe0c98cf7634c5dce3fe7cf3fa7ff2dc434

  • SSDEEP

    12288:yb96EMvksFJluEV7k/qb5EXY6F4YtHK0WScr5w18zi3N6sgI7o:/bV7k/tqwHK0cr5w18zi3N6sp7o

Score
10/10
neshtaevasionpersistencespywarestealer

Malware Config

Targets

    • Target

      d8d8c25f5deb919119bec928bde489942adbfe9cd3d831969ef5d35417ad7d63

    • Size

      639KB

    • MD5

      4252ada6d090e54ef59e088106f20340

    • SHA1

      15093e4433a995e25c7f45aab38744a73864a15c

    • SHA256

      d8d8c25f5deb919119bec928bde489942adbfe9cd3d831969ef5d35417ad7d63

    • SHA512

      4a1d331571654123bf26cca978b18585a9b427f79050996d04042567ff62149b2e3a4dbb2084cec516ae78e02d612fe0c98cf7634c5dce3fe7cf3fa7ff2dc434

    • SSDEEP

      12288:yb96EMvksFJluEV7k/qb5EXY6F4YtHK0WScr5w18zi3N6sgI7o:/bV7k/tqwHK0cr5w18zi3N6sp7o

    Score
    10/10
    neshtaevasionpersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks