Overview

overview

10

Static

static

10

5-NS new.exe

windows7-x64

10

5-NS new.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5-NS new.exe

  • Size

    165KB

  • Sample

    221127-tm21lsag32

  • MD5

    2f92ae6755fe716388233e0f42ae18b3

  • SHA1

    7aa1267b4c9a4f7a7a31266d6ca52b3df610c0f7

  • SHA256

    2538cc72df9e8af2222925e1d2b259778339f6fcd548b7b7e9b4e650ee01c3b7

  • SHA512

    c2618ce0c7317c5629065608901bb1c3a030167306cc285c51fa45e4e060fac1e10f77d4fbda29dca781fa636abf49647567708e4b5e98e54c3be1535317fc8f

  • SSDEEP

    3072:sr85Cn+cT7SoeNdqbMfN7TIdbV3GJQ56ef:k9n+EJeacOVcef

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      5-NS new.exe

    • Size

      165KB

    • MD5

      2f92ae6755fe716388233e0f42ae18b3

    • SHA1

      7aa1267b4c9a4f7a7a31266d6ca52b3df610c0f7

    • SHA256

      2538cc72df9e8af2222925e1d2b259778339f6fcd548b7b7e9b4e650ee01c3b7

    • SHA512

      c2618ce0c7317c5629065608901bb1c3a030167306cc285c51fa45e4e060fac1e10f77d4fbda29dca781fa636abf49647567708e4b5e98e54c3be1535317fc8f

    • SSDEEP

      3072:sr85Cn+cT7SoeNdqbMfN7TIdbV3GJQ56ef:k9n+EJeacOVcef

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks