Overview

overview

10

Static

static

10

06615aa82f...27.exe

windows7-x64

10

06615aa82f...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06615aa82fc1f22d638441677ad10d2d311ce652d52abd96618e4f47766e6727

  • Size

    776KB

  • Sample

    221119-3c3zlafc42

  • MD5

    269c60d04d600ad46c365a3ae4c48880

  • SHA1

    5658cf6ad38bb3fcc8fb8a6e827b1fa3cde38626

  • SHA256

    06615aa82fc1f22d638441677ad10d2d311ce652d52abd96618e4f47766e6727

  • SHA512

    ddb63d99a8059da1e4f165829d41b852d79b16731d268ab4e4c1ab18f9673b2f4d962618747e9f5f0f0cda8ba1e82a0929526418554165e9694163a55408a028

  • SSDEEP

    6144:k9XXjWsbG9zng8ULQa3AlXjWsbG9zng8ULQa3AMr:2XjWsb0znha3KXjWsb0znha3r

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      06615aa82fc1f22d638441677ad10d2d311ce652d52abd96618e4f47766e6727

    • Size

      776KB

    • MD5

      269c60d04d600ad46c365a3ae4c48880

    • SHA1

      5658cf6ad38bb3fcc8fb8a6e827b1fa3cde38626

    • SHA256

      06615aa82fc1f22d638441677ad10d2d311ce652d52abd96618e4f47766e6727

    • SHA512

      ddb63d99a8059da1e4f165829d41b852d79b16731d268ab4e4c1ab18f9673b2f4d962618747e9f5f0f0cda8ba1e82a0929526418554165e9694163a55408a028

    • SSDEEP

      6144:k9XXjWsbG9zng8ULQa3AlXjWsbG9zng8ULQa3AMr:2XjWsb0znha3KXjWsb0znha3r

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks