Overview

overview

10

Static

static

10

35f6969f46...b0.exe

windows7-x64

10

35f6969f46...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0

  • Size

    430KB

  • Sample

    221125-qa3jtsdc2y

  • MD5

    f2fa726aa15a0bedc7de81cab3c2a5db

  • SHA1

    a45ffdd8a301976719abe2f7400c0185b6662432

  • SHA256

    35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0

  • SHA512

    9413137d3eeb19a84b02ed8249074e1f1e6d2ff791786f682bd28ca32b3323c2980292b828023e9d01f82237fb2132f2632344cb625c631230f2c98b1f1c5b9b

  • SSDEEP

    6144:k9+feVjBpeExgVTFSXFoMc5RhCaL37mwww0JwwmSnvYqm9nxLW0Bs/kSTiOWGr9U:RZlPzCy37h8cW7Kcc

Score
10/10
neshtapersistencespywarestealerupx

Malware Config

Targets

    • Target

      35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0

    • Size

      430KB

    • MD5

      f2fa726aa15a0bedc7de81cab3c2a5db

    • SHA1

      a45ffdd8a301976719abe2f7400c0185b6662432

    • SHA256

      35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0

    • SHA512

      9413137d3eeb19a84b02ed8249074e1f1e6d2ff791786f682bd28ca32b3323c2980292b828023e9d01f82237fb2132f2632344cb625c631230f2c98b1f1c5b9b

    • SSDEEP

      6144:k9+feVjBpeExgVTFSXFoMc5RhCaL37mwww0JwwmSnvYqm9nxLW0Bs/kSTiOWGr9U:RZlPzCy37h8cW7Kcc

    Score
    10/10
    neshtapersistencespywarestealerupx

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks