General
-
Target
ff2ac248a6b780b1cecd43328a3a2bcf8f0171059a23211c079c7a0639face0a
-
Size
313KB
-
Sample
221121-ng188sca31
-
MD5
0a162a7f1e6199d8a6c66944c68634a0
-
SHA1
299d74d84565174e54db0a8d6c6a053fa317e87d
-
SHA256
ff2ac248a6b780b1cecd43328a3a2bcf8f0171059a23211c079c7a0639face0a
-
SHA512
f4dccf73b53a8bd271c5b79c54ef8007aebf20b1a525ef490d140fdc0c6fb923f06d604840f1539f0dc1b2a72a2aaf5917f5e0e82429f3c34976dd1c52e7b343
-
SSDEEP
6144:k9GCefFntQS7e8FBgMCChPXL8bbf08TxT:T57D6MhXgbbf08TxT
Behavioral task
behavioral1
Sample
ff2ac248a6b780b1cecd43328a3a2bcf8f0171059a23211c079c7a0639face0a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ff2ac248a6b780b1cecd43328a3a2bcf8f0171059a23211c079c7a0639face0a.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
ff2ac248a6b780b1cecd43328a3a2bcf8f0171059a23211c079c7a0639face0a
-
Size
313KB
-
MD5
0a162a7f1e6199d8a6c66944c68634a0
-
SHA1
299d74d84565174e54db0a8d6c6a053fa317e87d
-
SHA256
ff2ac248a6b780b1cecd43328a3a2bcf8f0171059a23211c079c7a0639face0a
-
SHA512
f4dccf73b53a8bd271c5b79c54ef8007aebf20b1a525ef490d140fdc0c6fb923f06d604840f1539f0dc1b2a72a2aaf5917f5e0e82429f3c34976dd1c52e7b343
-
SSDEEP
6144:k9GCefFntQS7e8FBgMCChPXL8bbf08TxT:T57D6MhXgbbf08TxT
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-