Overview

overview

10

Static

static

10

2c6717899a...35.exe

windows7-x64

10

2c6717899a...35.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c6717899aafbd9d11a45125e7f9a29ec8006e2be48b9b7fde1a5b07706fe235

  • Size

    1.3MB

  • Sample

    221125-wtbhcahb5y

  • MD5

    130ca32b605f04b46d79eb18a92aa301

  • SHA1

    7d353bfad7d0355e6599a1e6be50085dcc7cfbbe

  • SHA256

    2c6717899aafbd9d11a45125e7f9a29ec8006e2be48b9b7fde1a5b07706fe235

  • SHA512

    6c1d3e2becbf103a92bdc148e1eabd7b8c7185dd64716c3b6b1fe8222050d78fa1ce99f00ba67f9976871cec20eb7744e9942aaf5a7eade03d10ff69a9f912ea

  • SSDEEP

    24576:CgFKAQMlqoj6+2+Meg5PccDAdrVZq5ChT6I0xYxk+Ux3PNJ0HmhMvHM6Wa/up20V:/kMF6+ZMYc6rVZqQ6I6YGn3PP0GhoyYc

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      2c6717899aafbd9d11a45125e7f9a29ec8006e2be48b9b7fde1a5b07706fe235

    • Size

      1.3MB

    • MD5

      130ca32b605f04b46d79eb18a92aa301

    • SHA1

      7d353bfad7d0355e6599a1e6be50085dcc7cfbbe

    • SHA256

      2c6717899aafbd9d11a45125e7f9a29ec8006e2be48b9b7fde1a5b07706fe235

    • SHA512

      6c1d3e2becbf103a92bdc148e1eabd7b8c7185dd64716c3b6b1fe8222050d78fa1ce99f00ba67f9976871cec20eb7744e9942aaf5a7eade03d10ff69a9f912ea

    • SSDEEP

      24576:CgFKAQMlqoj6+2+Meg5PccDAdrVZq5ChT6I0xYxk+Ux3PNJ0HmhMvHM6Wa/up20V:/kMF6+ZMYc6rVZqQ6I6YGn3PP0GhoyYc

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks