Overview

overview

10

Static

static

10

753bdffceb...00.exe

windows7-x64

10

753bdffceb...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800

  • Size

    525KB

  • Sample

    221123-tkglwshd2t

  • MD5

    259997e0bd458c6b6c4854108afa2bfc

  • SHA1

    b80ed8abc3f34001bf07588b87abbdca2778678a

  • SHA256

    753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800

  • SHA512

    25784777e127e6871cecbbe3a15115c9468d8c7924b5729450d53a4480b977dc0676e04136b934b1e0c80c8d51e5accb6c67c81ffade27d63e6a71d47f8669d9

  • SSDEEP

    12288:5Mb4Xd+Uh8ggdE8Ox4GoyPV4qOr1nBMIQn68LXmhLXm2:5MbVujg9u4GBPVLOr1nvM68DmhDm2

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800

    • Size

      525KB

    • MD5

      259997e0bd458c6b6c4854108afa2bfc

    • SHA1

      b80ed8abc3f34001bf07588b87abbdca2778678a

    • SHA256

      753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800

    • SHA512

      25784777e127e6871cecbbe3a15115c9468d8c7924b5729450d53a4480b977dc0676e04136b934b1e0c80c8d51e5accb6c67c81ffade27d63e6a71d47f8669d9

    • SSDEEP

      12288:5Mb4Xd+Uh8ggdE8Ox4GoyPV4qOr1nBMIQn68LXmhLXm2:5MbVujg9u4GBPVLOr1nvM68DmhDm2

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks