Overview

overview

10

Static

static

5

7fb0346eb8...89.exe

windows7-x64

10

7fb0346eb8...89.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7fb0346eb8ce7d98a79084eeff1ddcd115ecfd1150a26bb52b39989b16267689

  • Size

    1.6MB

  • Sample

    221126-ygjpasac23

  • MD5

    086843be3574888c82076e12756a2d4d

  • SHA1

    39df0a6268554f87b6a0937fec8ad116c0cc70d1

  • SHA256

    7fb0346eb8ce7d98a79084eeff1ddcd115ecfd1150a26bb52b39989b16267689

  • SHA512

    a8e19d6dcc277fec6350f967676798142497f7b44ca1f26296fc50e070f96191848021a912bd073c56a560b55ca963230ee6a50d1efb82fc0ef311b6bf7bd765

  • SSDEEP

    49152:1Vg5tQ7aOcbf5tIs5LkIO3k9dCwh69R3jfm:7g56CbksLkLkrCq6z3jfm

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      7fb0346eb8ce7d98a79084eeff1ddcd115ecfd1150a26bb52b39989b16267689

    • Size

      1.6MB

    • MD5

      086843be3574888c82076e12756a2d4d

    • SHA1

      39df0a6268554f87b6a0937fec8ad116c0cc70d1

    • SHA256

      7fb0346eb8ce7d98a79084eeff1ddcd115ecfd1150a26bb52b39989b16267689

    • SHA512

      a8e19d6dcc277fec6350f967676798142497f7b44ca1f26296fc50e070f96191848021a912bd073c56a560b55ca963230ee6a50d1efb82fc0ef311b6bf7bd765

    • SSDEEP

      49152:1Vg5tQ7aOcbf5tIs5LkIO3k9dCwh69R3jfm:7g56CbksLkLkrCq6z3jfm

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks