Overview

overview

10

Static

static

10

fad7adf093...4b.exe

windows7-x64

10

fad7adf093...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fad7adf09371d45adb62734187fc9a8625cbc6056a45a7f5d70e736a576f9c4b

  • Size

    276KB

  • Sample

    221129-jx4l3sah46

  • MD5

    2030a16f332e37a62a760e3b950d7850

  • SHA1

    c7447c72619760c311a41426fd33739ef56378b7

  • SHA256

    fad7adf09371d45adb62734187fc9a8625cbc6056a45a7f5d70e736a576f9c4b

  • SHA512

    3fb9669f870cddf338ccd74fed366727cb9f2ad90bcb73004848be61aefb3972f59845f73c2822a264f1ca7c9f7fc9a8db3dc3cfa68fac2710dbef8bb6c74a64

  • SSDEEP

    6144:k9vVDh01yJcGqFcrDTZQdvOXstC2db5vTm:CDhSyJKKTiistCOM

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      fad7adf09371d45adb62734187fc9a8625cbc6056a45a7f5d70e736a576f9c4b

    • Size

      276KB

    • MD5

      2030a16f332e37a62a760e3b950d7850

    • SHA1

      c7447c72619760c311a41426fd33739ef56378b7

    • SHA256

      fad7adf09371d45adb62734187fc9a8625cbc6056a45a7f5d70e736a576f9c4b

    • SHA512

      3fb9669f870cddf338ccd74fed366727cb9f2ad90bcb73004848be61aefb3972f59845f73c2822a264f1ca7c9f7fc9a8db3dc3cfa68fac2710dbef8bb6c74a64

    • SSDEEP

      6144:k9vVDh01yJcGqFcrDTZQdvOXstC2db5vTm:CDhSyJKKTiistCOM

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks