Overview

overview

10

Static

static

363b294f31...b5.exe

windows7-x64

10

363b294f31...b5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    363b294f310c6a4578d1d4fc5bc2fbdfcab2b2e6ee033c0fa44f11430b574db5

  • Size

    507KB

  • Sample

    221119-3fhg3aaf2y

  • MD5

    3e273632856cdaf6171def30af3ddba0

  • SHA1

    8b7f007bf6ba22dcd385f927a6e64f0ba15e584e

  • SHA256

    363b294f310c6a4578d1d4fc5bc2fbdfcab2b2e6ee033c0fa44f11430b574db5

  • SHA512

    57661903687e4eeaea1e665fbffaa9dbe49f7597e73f2f68cad03e60d656d8917ede3b1dc05abf0e0d5d6788caa79b417a20dcb7cbe5ed0cac1662de259a5818

  • SSDEEP

    12288:jayti3n8BcaaNHiI7XHgZQKhJgeCmefHq0HHebl:jaN8xaNHtLHgZpJEhJH6l

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      363b294f310c6a4578d1d4fc5bc2fbdfcab2b2e6ee033c0fa44f11430b574db5

    • Size

      507KB

    • MD5

      3e273632856cdaf6171def30af3ddba0

    • SHA1

      8b7f007bf6ba22dcd385f927a6e64f0ba15e584e

    • SHA256

      363b294f310c6a4578d1d4fc5bc2fbdfcab2b2e6ee033c0fa44f11430b574db5

    • SHA512

      57661903687e4eeaea1e665fbffaa9dbe49f7597e73f2f68cad03e60d656d8917ede3b1dc05abf0e0d5d6788caa79b417a20dcb7cbe5ed0cac1662de259a5818

    • SSDEEP

      12288:jayti3n8BcaaNHiI7XHgZQKhJgeCmefHq0HHebl:jaN8xaNHtLHgZpJEhJH6l

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks