Overview

overview

10

Static

static

10

ab506c28f3...36.exe

windows7-x64

10

ab506c28f3...36.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab506c28f37c54b902425951c63a93e317d869b46299cdeb0641cbc14e345736

  • Size

    119KB

  • Sample

    221125-wsvvladh66

  • MD5

    dcb624237fb92901c66e3c05ccab649f

  • SHA1

    044d1ae43fdc8ec936f2b6bfd4a412ae3385d76f

  • SHA256

    ab506c28f37c54b902425951c63a93e317d869b46299cdeb0641cbc14e345736

  • SHA512

    c759aa8b72a1874163f50a7a865a96a24909a195f849cbaf8cd38aa41fc63e06aa4969edf3e421d09c990bf55cfe2874d93b026f2b0de97a8ea57cee7f3a02f2

  • SSDEEP

    1536:JxqjQ+P04wsmJCgTK2tBinz1Gj0JH4bLvjaW8C87Bym9xS3qv5lGsI87c/9G:sr85CgmXzHJYnvW3CmByk4u5v5c1G

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      ab506c28f37c54b902425951c63a93e317d869b46299cdeb0641cbc14e345736

    • Size

      119KB

    • MD5

      dcb624237fb92901c66e3c05ccab649f

    • SHA1

      044d1ae43fdc8ec936f2b6bfd4a412ae3385d76f

    • SHA256

      ab506c28f37c54b902425951c63a93e317d869b46299cdeb0641cbc14e345736

    • SHA512

      c759aa8b72a1874163f50a7a865a96a24909a195f849cbaf8cd38aa41fc63e06aa4969edf3e421d09c990bf55cfe2874d93b026f2b0de97a8ea57cee7f3a02f2

    • SSDEEP

      1536:JxqjQ+P04wsmJCgTK2tBinz1Gj0JH4bLvjaW8C87Bym9xS3qv5lGsI87c/9G:sr85CgmXzHJYnvW3CmByk4u5v5c1G

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks