Overview

overview

10

Static

static

edf73b38a1...cf.exe

windows7-x64

10

edf73b38a1...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edf73b38a178f1ac52c674646c5c8c815cbd1c1a76896419904ff860107c64cf

  • Size

    40KB

  • Sample

    221121-ngnm5sca2z

  • MD5

    25d2d08b7112e4d4a28f2f2af74811d0

  • SHA1

    d80c10c0f97a3e497a6f820677cab9cd3c0ee69c

  • SHA256

    edf73b38a178f1ac52c674646c5c8c815cbd1c1a76896419904ff860107c64cf

  • SHA512

    90ccf3c7c21473b01231f08be5c803b8d49dd76113fd66ec914a72980a196925a72bf5ccf12e749211fbe9fa6f3beae7f88f7590ce51ec5da6447f3683fc3872

  • SSDEEP

    768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJsZeN/ddbqR:yxqjQ+P04wsZLnDrCvINVd4

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      edf73b38a178f1ac52c674646c5c8c815cbd1c1a76896419904ff860107c64cf

    • Size

      40KB

    • MD5

      25d2d08b7112e4d4a28f2f2af74811d0

    • SHA1

      d80c10c0f97a3e497a6f820677cab9cd3c0ee69c

    • SHA256

      edf73b38a178f1ac52c674646c5c8c815cbd1c1a76896419904ff860107c64cf

    • SHA512

      90ccf3c7c21473b01231f08be5c803b8d49dd76113fd66ec914a72980a196925a72bf5ccf12e749211fbe9fa6f3beae7f88f7590ce51ec5da6447f3683fc3872

    • SSDEEP

      768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJsZeN/ddbqR:yxqjQ+P04wsZLnDrCvINVd4

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks