Overview

overview

10

Static

static

10

da2aacbd75...87.exe

windows7-x64

10

da2aacbd75...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da2aacbd755c284e1122aac8fd3ca5772cce04a13c5c62119770aa1cf3687d87

  • Size

    88KB

  • Sample

    221125-wte6jaea25

  • MD5

    d9a9ea1c848793138f91e029122a3c64

  • SHA1

    95b4c2d7c98948ce1773e90ec4740fe132e34350

  • SHA256

    da2aacbd755c284e1122aac8fd3ca5772cce04a13c5c62119770aa1cf3687d87

  • SHA512

    73f290a45cfe68aba845297222ada09160fc607f0d1d6dfb0bebae9918295df4127a425a7ff70fa9c4c4ea49a4e430788f436cf7c234ea65bf828d2bb422f6cb

  • SSDEEP

    768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ1zOXhN2Mnsk2yg3fZ9+Rj3qDHLxdc0:JxqjQ+P04wsmJCmzOm9+Z3qDFS

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      da2aacbd755c284e1122aac8fd3ca5772cce04a13c5c62119770aa1cf3687d87

    • Size

      88KB

    • MD5

      d9a9ea1c848793138f91e029122a3c64

    • SHA1

      95b4c2d7c98948ce1773e90ec4740fe132e34350

    • SHA256

      da2aacbd755c284e1122aac8fd3ca5772cce04a13c5c62119770aa1cf3687d87

    • SHA512

      73f290a45cfe68aba845297222ada09160fc607f0d1d6dfb0bebae9918295df4127a425a7ff70fa9c4c4ea49a4e430788f436cf7c234ea65bf828d2bb422f6cb

    • SSDEEP

      768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ1zOXhN2Mnsk2yg3fZ9+Rj3qDHLxdc0:JxqjQ+P04wsmJCmzOm9+Z3qDFS

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks