Overview

overview

10

Static

static

10

1955ed9b77...7a.exe

windows7-x64

10

1955ed9b77...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1955ed9b778e0217c2288e6bceb5db82bb86807c2e0558ecff888a5aad55637a

  • Size

    1.8MB

  • Sample

    221125-wtfr3aea26

  • MD5

    1a7cbe94061cc21cfae2748d19590426

  • SHA1

    3b85b94a1f3425d830047d551334b52451d17063

  • SHA256

    1955ed9b778e0217c2288e6bceb5db82bb86807c2e0558ecff888a5aad55637a

  • SHA512

    92658e6c83b1a01d7b72c1231644788117a0901f55538f61085f2595a12ef19883bb305eca7294b067d2c79c86677469b0bd16de9170bc26f5381a09ee607ab9

  • SSDEEP

    24576:+LPFLP8SHBKpXlRnxliRUHa9HFXZhHMLY+NxQzFd3msSUKieLP1:+L9L0S8pVRNYp2LxHQzFd3g5Ld

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      1955ed9b778e0217c2288e6bceb5db82bb86807c2e0558ecff888a5aad55637a

    • Size

      1.8MB

    • MD5

      1a7cbe94061cc21cfae2748d19590426

    • SHA1

      3b85b94a1f3425d830047d551334b52451d17063

    • SHA256

      1955ed9b778e0217c2288e6bceb5db82bb86807c2e0558ecff888a5aad55637a

    • SHA512

      92658e6c83b1a01d7b72c1231644788117a0901f55538f61085f2595a12ef19883bb305eca7294b067d2c79c86677469b0bd16de9170bc26f5381a09ee607ab9

    • SSDEEP

      24576:+LPFLP8SHBKpXlRnxliRUHa9HFXZhHMLY+NxQzFd3msSUKieLP1:+L9L0S8pVRNYp2LxHQzFd3g5Ld

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks