Overview

overview

10

Static

static

10

217be34437...c3.exe

windows7-x64

10

217be34437...c3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    217be3443718953cf4066be8df887d246b907cb11245b2ab23a29c38d10c2ac3

  • Size

    113KB

  • Sample

    221126-dfrcjaga65

  • MD5

    00fbea71b3f5a7edda3b2f6e78f3a0a0

  • SHA1

    3effcc8a06bcfb1b41c02641decac20442dd5f90

  • SHA256

    217be3443718953cf4066be8df887d246b907cb11245b2ab23a29c38d10c2ac3

  • SHA512

    422dd240f81f8cc3123aee70c4601c5f9c9390f308b3c3e3f3cbe2fc89152e1061ebddfbb8d3272c380cdbc5c7a9d24e8c5b90eb39a27f11e96585cca26177c6

  • SSDEEP

    1536:JxqjQ+P04wsmJCfuXp0Gbhx8ry9YVkbM0soilFeSux+VweJVOZHEDokI7X96LJ++:sr85CTGbhmroM0sHl5uwm5E1uOt

Score
10/10
neshtapersistencespywarestealerupx

Malware Config

Targets

    • Target

      217be3443718953cf4066be8df887d246b907cb11245b2ab23a29c38d10c2ac3

    • Size

      113KB

    • MD5

      00fbea71b3f5a7edda3b2f6e78f3a0a0

    • SHA1

      3effcc8a06bcfb1b41c02641decac20442dd5f90

    • SHA256

      217be3443718953cf4066be8df887d246b907cb11245b2ab23a29c38d10c2ac3

    • SHA512

      422dd240f81f8cc3123aee70c4601c5f9c9390f308b3c3e3f3cbe2fc89152e1061ebddfbb8d3272c380cdbc5c7a9d24e8c5b90eb39a27f11e96585cca26177c6

    • SSDEEP

      1536:JxqjQ+P04wsmJCfuXp0Gbhx8ry9YVkbM0soilFeSux+VweJVOZHEDokI7X96LJ++:sr85CTGbhmroM0sHl5uwm5E1uOt

    Score
    10/10
    neshtapersistencespywarestealerupx

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks