Overview

overview

10

Static

static

10

1803747b30...80.exe

windows7-x64

10

1803747b30...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1803747b301d0be36e51439916ca4b46e3782be203e58a6e82db93f0a715d780

  • Size

    133KB

  • Sample

    221121-nh3hpagd58

  • MD5

    13179a46da1bd4e06558c2cabddd04a0

  • SHA1

    77a5f874c6dd37f463dbc9af80a3bdc48eb4af9b

  • SHA256

    1803747b301d0be36e51439916ca4b46e3782be203e58a6e82db93f0a715d780

  • SHA512

    44a72532522c0cd8eff666dcf62a235a6e830546f92264a328e44498d79d2a47105969f88b40203f703be3f24594cc08da59c3df81672d4b0ff7194909fdfe1a

  • SSDEEP

    1536:JxqjQ+P04wsmJCNAWkJ371OxqjQ+P04wsmJC:sr85CK/JLJr85C

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      1803747b301d0be36e51439916ca4b46e3782be203e58a6e82db93f0a715d780

    • Size

      133KB

    • MD5

      13179a46da1bd4e06558c2cabddd04a0

    • SHA1

      77a5f874c6dd37f463dbc9af80a3bdc48eb4af9b

    • SHA256

      1803747b301d0be36e51439916ca4b46e3782be203e58a6e82db93f0a715d780

    • SHA512

      44a72532522c0cd8eff666dcf62a235a6e830546f92264a328e44498d79d2a47105969f88b40203f703be3f24594cc08da59c3df81672d4b0ff7194909fdfe1a

    • SSDEEP

      1536:JxqjQ+P04wsmJCNAWkJ371OxqjQ+P04wsmJC:sr85CK/JLJr85C

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks