Overview

overview

10

Static

static

10

2703e00798...4b.exe

windows7-x64

10

2703e00798...4b.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2703e007984b6f13f2c2a0547ff6084e2aa88ca4aff89233bc45fc288b4dac4b

  • Size

    412KB

  • Sample

    221125-qa4rwsaa44

  • MD5

    086f75f505adfc0e604c0e74a94a7ada

  • SHA1

    6344e3f3e88e357b8e6ac32de0b0e85596140902

  • SHA256

    2703e007984b6f13f2c2a0547ff6084e2aa88ca4aff89233bc45fc288b4dac4b

  • SHA512

    4dc6450b7460b501020ad20100b07c8b5935414c40b6780c8aa54f866a8f3204dd2d3eec36721435f542cf247740b8233cfdf03b32406d7ccbab020c94e0561e

  • SSDEEP

    3072:sr85C+RkqTBMwaCrISdz42P3blJUQdvZaBXe7g7S:k9ET6waCrI/2PxxuXekS

Score
10/10
neshtanjratpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      2703e007984b6f13f2c2a0547ff6084e2aa88ca4aff89233bc45fc288b4dac4b

    • Size

      412KB

    • MD5

      086f75f505adfc0e604c0e74a94a7ada

    • SHA1

      6344e3f3e88e357b8e6ac32de0b0e85596140902

    • SHA256

      2703e007984b6f13f2c2a0547ff6084e2aa88ca4aff89233bc45fc288b4dac4b

    • SHA512

      4dc6450b7460b501020ad20100b07c8b5935414c40b6780c8aa54f866a8f3204dd2d3eec36721435f542cf247740b8233cfdf03b32406d7ccbab020c94e0561e

    • SSDEEP

      3072:sr85C+RkqTBMwaCrISdz42P3blJUQdvZaBXe7g7S:k9ET6waCrI/2PxxuXekS

    Score
    10/10
    neshtanjratpersistencespywarestealertrojan

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks