Overview

overview

10

Static

static

10

622295d656...8c.exe

windows7-x64

10

622295d656...8c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    622295d6561a1e13f7ddb40ec2e8db8e1f6ea25a9df42def48a0bb942c75be8c

  • Size

    881KB

  • Sample

    221121-nhp8csgd45

  • MD5

    3b7a29fcd554ddc72806f39ddd00a690

  • SHA1

    0c176fd878ea301ca25dcde80bf22d0f3b1c0844

  • SHA256

    622295d6561a1e13f7ddb40ec2e8db8e1f6ea25a9df42def48a0bb942c75be8c

  • SHA512

    656457e083e1c40ae3bf78379a64d70e6066a37c358572729fa197b7001d959bf35b41c459c67506388da58b3a7fffb8af26674b308faf2cea4ff21c98a01a19

  • SSDEEP

    24576:S8uOifB5jY+ucT7nHPePa0PrC8JzGhVXn7:vuhvhTbvAaWCbXn7

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      622295d6561a1e13f7ddb40ec2e8db8e1f6ea25a9df42def48a0bb942c75be8c

    • Size

      881KB

    • MD5

      3b7a29fcd554ddc72806f39ddd00a690

    • SHA1

      0c176fd878ea301ca25dcde80bf22d0f3b1c0844

    • SHA256

      622295d6561a1e13f7ddb40ec2e8db8e1f6ea25a9df42def48a0bb942c75be8c

    • SHA512

      656457e083e1c40ae3bf78379a64d70e6066a37c358572729fa197b7001d959bf35b41c459c67506388da58b3a7fffb8af26674b308faf2cea4ff21c98a01a19

    • SSDEEP

      24576:S8uOifB5jY+ucT7nHPePa0PrC8JzGhVXn7:vuhvhTbvAaWCbXn7

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks