Overview

overview

10

Static

static

10

faccfbbdc3...1b.exe

windows7-x64

10

faccfbbdc3...1b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    faccfbbdc313a2f4b1d80119de898312b8fd84f586c4d5cf2482382910940f1b

  • Size

    619KB

  • Sample

    221125-xgtzlaba3t

  • MD5

    aac0d0a0ee44507e808062e7490182ab

  • SHA1

    90c0bad36477ad99961eac4f5eab433821d286d1

  • SHA256

    faccfbbdc313a2f4b1d80119de898312b8fd84f586c4d5cf2482382910940f1b

  • SHA512

    f999ce49df95145891ba3d9e268556d61c50a6b0e75edc39909dac916546bae900b2f35538780b4f5dff005dafe5ec6d043cdb34068836d0ca43e9027aa80124

  • SSDEEP

    3072:sr85CdAnnnnnnnnnnnnnnnnttKR7EEusaY89j+sEoyV5/hH1ARqAnnnnnnnnnnn2:k9d2gR7Tusa99j+qouY2gR7Tusa99j+B

Score
10/10
neshtapersistencespyware

Malware Config

Targets

    • Target

      faccfbbdc313a2f4b1d80119de898312b8fd84f586c4d5cf2482382910940f1b

    • Size

      619KB

    • MD5

      aac0d0a0ee44507e808062e7490182ab

    • SHA1

      90c0bad36477ad99961eac4f5eab433821d286d1

    • SHA256

      faccfbbdc313a2f4b1d80119de898312b8fd84f586c4d5cf2482382910940f1b

    • SHA512

      f999ce49df95145891ba3d9e268556d61c50a6b0e75edc39909dac916546bae900b2f35538780b4f5dff005dafe5ec6d043cdb34068836d0ca43e9027aa80124

    • SSDEEP

      3072:sr85CdAnnnnnnnnnnnnnnnnttKR7EEusaY89j+sEoyV5/hH1ARqAnnnnnnnnnnn2:k9d2gR7Tusa99j+qouY2gR7Tusa99j+B

    Score
    10/10
    neshtapersistencespyware

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks