Overview

overview

10

Static

static

1a25ccb129...a8.exe

windows7-x64

10

1a25ccb129...a8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a25ccb1295b27a5b197be9647ccef60a682f0a3fe552597a72f21ef0f13c6a8

  • Size

    554KB

  • Sample

    221119-m8y3hsha36

  • MD5

    24fbec03dd760b49ee9c43ebc7c14993

  • SHA1

    515efc96e77f88b47e1f8997d76ebaaaebe1c8e6

  • SHA256

    1a25ccb1295b27a5b197be9647ccef60a682f0a3fe552597a72f21ef0f13c6a8

  • SHA512

    5cc923f8b2e8854d7959cc4990b62555ffc46fa879d8a582d7c53f5a6ac5a00c567ed9be6657e247b237bd8296f7edbc71331461f9e04ece8b5f780c97facdf8

  • SSDEEP

    12288:PpemN8eLQYfTD4AqzDkOXZm6+/ehJy58J2vvruGgOiXvA:RVLD6DU/FiJ2vyGavA

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      1a25ccb1295b27a5b197be9647ccef60a682f0a3fe552597a72f21ef0f13c6a8

    • Size

      554KB

    • MD5

      24fbec03dd760b49ee9c43ebc7c14993

    • SHA1

      515efc96e77f88b47e1f8997d76ebaaaebe1c8e6

    • SHA256

      1a25ccb1295b27a5b197be9647ccef60a682f0a3fe552597a72f21ef0f13c6a8

    • SHA512

      5cc923f8b2e8854d7959cc4990b62555ffc46fa879d8a582d7c53f5a6ac5a00c567ed9be6657e247b237bd8296f7edbc71331461f9e04ece8b5f780c97facdf8

    • SSDEEP

      12288:PpemN8eLQYfTD4AqzDkOXZm6+/ehJy58J2vvruGgOiXvA:RVLD6DU/FiJ2vyGavA

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks