Overview

overview

10

Static

static

10

0651eb36fb...11.exe

windows7-x64

10

0651eb36fb...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0651eb36fb416e496a4b43be732f87872d72cfa812beafa071515588c89f9c11

  • Size

    601KB

  • Sample

    221127-c5jtbadc66

  • MD5

    679e100f630ae3a79e1750bc15498ad5

  • SHA1

    aeaead2657d304f8f7ec278da9e202764889dcdf

  • SHA256

    0651eb36fb416e496a4b43be732f87872d72cfa812beafa071515588c89f9c11

  • SHA512

    b567c93b679aeb3b578a7c861294cead35c685ef0df8ecab7d50d17db3615d81008520ad26748720d494c291ea5c8f2d839f0fbe667001af46ea0e2d0a82f13c

  • SSDEEP

    12288:H9OczTX1g+ACjgJ5Q+ON9R4qeACjdXE1cVKB/5EJz6L/tIoTGgsV:dO2TlgLCI5LON9R4qXCd0mYESKoTGgsV

Score
10/10
neshtapersistencespywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Churbanka55555999

Targets

    • Target

      0651eb36fb416e496a4b43be732f87872d72cfa812beafa071515588c89f9c11

    • Size

      601KB

    • MD5

      679e100f630ae3a79e1750bc15498ad5

    • SHA1

      aeaead2657d304f8f7ec278da9e202764889dcdf

    • SHA256

      0651eb36fb416e496a4b43be732f87872d72cfa812beafa071515588c89f9c11

    • SHA512

      b567c93b679aeb3b578a7c861294cead35c685ef0df8ecab7d50d17db3615d81008520ad26748720d494c291ea5c8f2d839f0fbe667001af46ea0e2d0a82f13c

    • SSDEEP

      12288:H9OczTX1g+ACjgJ5Q+ON9R4qeACjdXE1cVKB/5EJz6L/tIoTGgsV:dO2TlgLCI5LON9R4qXCd0mYESKoTGgsV

    Score
    10/10
    neshtapersistencespywarestealerupx

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks