Overview

overview

10

Static

static

ea9d43e522...f9.exe

windows7-x64

10

ea9d43e522...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea9d43e522bd91839774b75e322238cd3ab6b901bb22200adff0067c3c8e67f9

  • Size

    200KB

  • Sample

    221129-jx7czadh9y

  • MD5

    e7d6c241f8904e9fe74d8dc92d815778

  • SHA1

    e9b9e56c50c86250617dd238b3f5165d0b0f24b5

  • SHA256

    ea9d43e522bd91839774b75e322238cd3ab6b901bb22200adff0067c3c8e67f9

  • SHA512

    eb4ad7d33920a85293ba1e3a0378f6861afe71791e1890fe657baf8c7b8bf738af92573777352720c24c756fec138ef0d4e6e09a0d0353b970d83b084ce93c3e

  • SSDEEP

    3072:kr85CE9h4rJA8tT+tOuai2G8l0AR/oz1XtjxjdJ0GFFbMzSP8EY8jwy1:c9EiA9tOC2G8uANy1VN0GjoA8sL

Score
10/10
neshtapersistencespywarestealerupx

Malware Config

Targets

    • Target

      ea9d43e522bd91839774b75e322238cd3ab6b901bb22200adff0067c3c8e67f9

    • Size

      200KB

    • MD5

      e7d6c241f8904e9fe74d8dc92d815778

    • SHA1

      e9b9e56c50c86250617dd238b3f5165d0b0f24b5

    • SHA256

      ea9d43e522bd91839774b75e322238cd3ab6b901bb22200adff0067c3c8e67f9

    • SHA512

      eb4ad7d33920a85293ba1e3a0378f6861afe71791e1890fe657baf8c7b8bf738af92573777352720c24c756fec138ef0d4e6e09a0d0353b970d83b084ce93c3e

    • SSDEEP

      3072:kr85CE9h4rJA8tT+tOuai2G8l0AR/oz1XtjxjdJ0GFFbMzSP8EY8jwy1:c9EiA9tOC2G8uANy1VN0GjoA8sL

    Score
    10/10
    neshtapersistencespywarestealerupx

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks