Overview

overview

10

Static

static

10

18f22acd34...ab.exe

windows7-x64

10

18f22acd34...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18f22acd344c4b666a16e87c12e85c559b46661f21bc4b9f9f74cc9491bc68ab

  • Size

    415KB

  • Sample

    221121-nh2w6agd57

  • MD5

    1617a051a94b814a0c9c83630eefdcd0

  • SHA1

    662aafbf2d30af3a2b613d1d607770c547229055

  • SHA256

    18f22acd344c4b666a16e87c12e85c559b46661f21bc4b9f9f74cc9491bc68ab

  • SHA512

    71573a6ffbe78d1c5fd33713fd3dbd9bfe7bf4264dada5683930cb70678ca83ae0cf984ebeabcea39e96cc7df1b88bb9112c121021b979e64d696f2cb0481094

  • SSDEEP

    6144:k9uMS3HlLswnoM3uAe5Is4ETHVeuA0LfBWyjjalW83TBGGP+ZiVkOHKTI+PbwM9:iS3VYM3uAe5IsHTbA0IyUt3TgGGiePw

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      18f22acd344c4b666a16e87c12e85c559b46661f21bc4b9f9f74cc9491bc68ab

    • Size

      415KB

    • MD5

      1617a051a94b814a0c9c83630eefdcd0

    • SHA1

      662aafbf2d30af3a2b613d1d607770c547229055

    • SHA256

      18f22acd344c4b666a16e87c12e85c559b46661f21bc4b9f9f74cc9491bc68ab

    • SHA512

      71573a6ffbe78d1c5fd33713fd3dbd9bfe7bf4264dada5683930cb70678ca83ae0cf984ebeabcea39e96cc7df1b88bb9112c121021b979e64d696f2cb0481094

    • SSDEEP

      6144:k9uMS3HlLswnoM3uAe5Is4ETHVeuA0LfBWyjjalW83TBGGP+ZiVkOHKTI+PbwM9:iS3VYM3uAe5IsHTbA0IyUt3TgGGiePw

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks