Overview

overview

10

Static

static

10

5180e9e1ad...41.exe

windows7-x64

10

5180e9e1ad...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5180e9e1ad3b817d9554c0f11376bf505ff30eeb9b79a4c6a7c4e1f5d1781941

  • Size

    1.0MB

  • Sample

    221128-lwe87saa91

  • MD5

    88f6d0e4b99ae3c18647669fd0eaf7d7

  • SHA1

    0b75ef2d7e378a0cd893184ab62b83a96dea5776

  • SHA256

    5180e9e1ad3b817d9554c0f11376bf505ff30eeb9b79a4c6a7c4e1f5d1781941

  • SHA512

    b5af5c5611fadd5ebd6933dbd2dcc4a80c023b0870da43906b3a97f98cf755e97fec54c3d16447e2c8530d83e02f58c1c0ae9986b9fe25fbc60d70fd017fa16b

  • SSDEEP

    24576:9Eqlkq2LSaKsYTtKmA+AJddnWRZIT6d4pCbcwQbbC+/2:aqCvmtm+AJdhqCTPpAnha2

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      5180e9e1ad3b817d9554c0f11376bf505ff30eeb9b79a4c6a7c4e1f5d1781941

    • Size

      1.0MB

    • MD5

      88f6d0e4b99ae3c18647669fd0eaf7d7

    • SHA1

      0b75ef2d7e378a0cd893184ab62b83a96dea5776

    • SHA256

      5180e9e1ad3b817d9554c0f11376bf505ff30eeb9b79a4c6a7c4e1f5d1781941

    • SHA512

      b5af5c5611fadd5ebd6933dbd2dcc4a80c023b0870da43906b3a97f98cf755e97fec54c3d16447e2c8530d83e02f58c1c0ae9986b9fe25fbc60d70fd017fa16b

    • SSDEEP

      24576:9Eqlkq2LSaKsYTtKmA+AJddnWRZIT6d4pCbcwQbbC+/2:aqCvmtm+AJdhqCTPpAnha2

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks