Overview

overview

10

Static

static

10

c35a81c337...c5.exe

windows7-x64

10

c35a81c337...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c35a81c337994f6f1e3b51eff6eb843f784e8ba7a5ad9da6c9bd9dfb8ec707c5

  • Size

    883KB

  • Sample

    221127-csfk5acf29

  • MD5

    04dc4f7314f20c541a44be2c19563a94

  • SHA1

    5b1c0ea1a0a83406c5386db9005b058fe2045fd4

  • SHA256

    c35a81c337994f6f1e3b51eff6eb843f784e8ba7a5ad9da6c9bd9dfb8ec707c5

  • SHA512

    fedfdded69c594389f3d42122444e73b1be47a9ad35df1199b09e207e3b3ae07f49d89fae091670966a21577d06f4df3610c9b0815fb253d8ecfac0be1c93aac

  • SSDEEP

    12288:z3vu5WAEhqkiVQfu1Cx+L8IGWRlNFhnbDZ7QjRpRXACco3OxR+i:z3h8jQ/AG0llRkjR9PBi

Score
10/10
neshtaevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      c35a81c337994f6f1e3b51eff6eb843f784e8ba7a5ad9da6c9bd9dfb8ec707c5

    • Size

      883KB

    • MD5

      04dc4f7314f20c541a44be2c19563a94

    • SHA1

      5b1c0ea1a0a83406c5386db9005b058fe2045fd4

    • SHA256

      c35a81c337994f6f1e3b51eff6eb843f784e8ba7a5ad9da6c9bd9dfb8ec707c5

    • SHA512

      fedfdded69c594389f3d42122444e73b1be47a9ad35df1199b09e207e3b3ae07f49d89fae091670966a21577d06f4df3610c9b0815fb253d8ecfac0be1c93aac

    • SSDEEP

      12288:z3vu5WAEhqkiVQfu1Cx+L8IGWRlNFhnbDZ7QjRpRXACco3OxR+i:z3h8jQ/AG0llRkjR9PBi

    Score
    10/10
    neshtaevasionpersistencespywarestealertrojan

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks