Overview

overview

10

Static

static

Data/SMCEditor3.exe

windows7-x64

10

Data/SMCEditor3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed46cfba02d10fecc07d22caf98422764ccb7fc822700248591b7c452e2b864d

  • Size

    587KB

  • Sample

    221124-lf6ffsha3x

  • MD5

    daaedf81b62f190ec79871ab28e47aa1

  • SHA1

    307d0f8afb2c642873465fa95f2070621871ba55

  • SHA256

    ed46cfba02d10fecc07d22caf98422764ccb7fc822700248591b7c452e2b864d

  • SHA512

    6e16627d47448888457a25807b12bb72658fb1adb9bb9cbae717763f7cbe7cf48087cae69428386c7d470780905478e779a655e94f065eb591bfe91a133de35f

  • SSDEEP

    12288:PzgDoRNvRHEEEEEE01BL8km7NoewczhjV0qxuk2KOM+Xn5p+QZirVk:PzgDoL8ZKpZTjVbQk2fM+XH4C

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      Data/SMCEditor3.exe

    • Size

      276KB

    • MD5

      58afe77ecdf2fbe59c5108293f87b39f

    • SHA1

      44b7dc48c962fb4ff763015bfecc58e1bdc023c4

    • SHA256

      a81341e65bb9817b6bd7261bfc043b753c0863275a6c69bdd4f10123f08a5aab

    • SHA512

      ae6f8f8e9b57734c4fbf757ab768a7ede96d2fd610a38c3ab2bd97c746150f815711ba116c50f73121b94be75c654c46cd7998ffeb0e1d4dced089931cc39d61

    • SSDEEP

      3072:zr8WDrCyeUxqtyxbzHysdpXTDX8C8wQd7X1pkrmOAYym9wGgvNxlce6H:PuyDxJx3yKpXTDX8fPkbAcqDZcBH

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks