Overview

overview

10

Static

static

10

7c0ed0f2b7...f9.exe

windows7-x64

10

7c0ed0f2b7...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c0ed0f2b7cd99e442029ff585c21403e6745533cb0fb6e2e9c62e9bd86f9ef9

  • Size

    821KB

  • Sample

    221128-c85j7adf4z

  • MD5

    1a3b15a67092446a15258995e6fae3ac

  • SHA1

    ce717a0d35b775fd868ab148d85f52227cd0de6e

  • SHA256

    7c0ed0f2b7cd99e442029ff585c21403e6745533cb0fb6e2e9c62e9bd86f9ef9

  • SHA512

    587670a19a76ab3417b6e00a3b2d8c2654fbdb0d3eb965fd48f775c5fa113ce36856a8dbdb2c74ad587d7454c4dde24b7fd92a85eb147862a2f19f34c7737d0e

  • SSDEEP

    24576:WO2TlgLCI5LON9R4qXCd0mYESKoTGgiRYEW2oEds:WxlgR5aB46Cd15NiGNvWPEs

Score
10/10
neshtapersistencespywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    krasht123@gmail.com
  • Password:
    krasht235

Targets

    • Target

      7c0ed0f2b7cd99e442029ff585c21403e6745533cb0fb6e2e9c62e9bd86f9ef9

    • Size

      821KB

    • MD5

      1a3b15a67092446a15258995e6fae3ac

    • SHA1

      ce717a0d35b775fd868ab148d85f52227cd0de6e

    • SHA256

      7c0ed0f2b7cd99e442029ff585c21403e6745533cb0fb6e2e9c62e9bd86f9ef9

    • SHA512

      587670a19a76ab3417b6e00a3b2d8c2654fbdb0d3eb965fd48f775c5fa113ce36856a8dbdb2c74ad587d7454c4dde24b7fd92a85eb147862a2f19f34c7737d0e

    • SSDEEP

      24576:WO2TlgLCI5LON9R4qXCd0mYESKoTGgiRYEW2oEds:WxlgR5aB46Cd15NiGNvWPEs

    Score
    10/10
    neshtapersistencespywarestealerupx

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks