Overview

overview

10

Static

static

a81341e65b...ab.exe

windows7-x64

10

a81341e65b...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a81341e65bb9817b6bd7261bfc043b753c0863275a6c69bdd4f10123f08a5aab

  • Size

    276KB

  • Sample

    221124-lf31bsea57

  • MD5

    58afe77ecdf2fbe59c5108293f87b39f

  • SHA1

    44b7dc48c962fb4ff763015bfecc58e1bdc023c4

  • SHA256

    a81341e65bb9817b6bd7261bfc043b753c0863275a6c69bdd4f10123f08a5aab

  • SHA512

    ae6f8f8e9b57734c4fbf757ab768a7ede96d2fd610a38c3ab2bd97c746150f815711ba116c50f73121b94be75c654c46cd7998ffeb0e1d4dced089931cc39d61

  • SSDEEP

    3072:zr8WDrCyeUxqtyxbzHysdpXTDX8C8wQd7X1pkrmOAYym9wGgvNxlce6H:PuyDxJx3yKpXTDX8fPkbAcqDZcBH

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      a81341e65bb9817b6bd7261bfc043b753c0863275a6c69bdd4f10123f08a5aab

    • Size

      276KB

    • MD5

      58afe77ecdf2fbe59c5108293f87b39f

    • SHA1

      44b7dc48c962fb4ff763015bfecc58e1bdc023c4

    • SHA256

      a81341e65bb9817b6bd7261bfc043b753c0863275a6c69bdd4f10123f08a5aab

    • SHA512

      ae6f8f8e9b57734c4fbf757ab768a7ede96d2fd610a38c3ab2bd97c746150f815711ba116c50f73121b94be75c654c46cd7998ffeb0e1d4dced089931cc39d61

    • SSDEEP

      3072:zr8WDrCyeUxqtyxbzHysdpXTDX8C8wQd7X1pkrmOAYym9wGgvNxlce6H:PuyDxJx3yKpXTDX8fPkbAcqDZcBH

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks