Overview

overview

10

Static

static

10

d1f81b0a40...6c.exe

windows7-x64

10

d1f81b0a40...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1f81b0a4047814bd4812014d1ec5726e9bf25fc9423426208e96250080a196c

  • Size

    466KB

  • Sample

    221130-at5wasfe71

  • MD5

    d2504aee17a7bc4a44bfd0dc99b5ea5c

  • SHA1

    5d2565008ff0f19699bb95b3c2b4173e028de2b2

  • SHA256

    d1f81b0a4047814bd4812014d1ec5726e9bf25fc9423426208e96250080a196c

  • SHA512

    cfea400bd1e5e94c8025deff3e7236450cc3e19d7e62261aef58c02cc214adc3d9d1320c61f53cefa440be9785bdf7dc100e3607d82ffd497f4ed7e50e9b3826

  • SSDEEP

    6144:k9eI0CG4igKe34OUeRUqNtyH7xOc6H5c6HcT66vlmrOUeRUq0KtyH7xOc6H5c6H9:RIS434enaKe/aKe/aKe/a

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      d1f81b0a4047814bd4812014d1ec5726e9bf25fc9423426208e96250080a196c

    • Size

      466KB

    • MD5

      d2504aee17a7bc4a44bfd0dc99b5ea5c

    • SHA1

      5d2565008ff0f19699bb95b3c2b4173e028de2b2

    • SHA256

      d1f81b0a4047814bd4812014d1ec5726e9bf25fc9423426208e96250080a196c

    • SHA512

      cfea400bd1e5e94c8025deff3e7236450cc3e19d7e62261aef58c02cc214adc3d9d1320c61f53cefa440be9785bdf7dc100e3607d82ffd497f4ed7e50e9b3826

    • SSDEEP

      6144:k9eI0CG4igKe34OUeRUqNtyH7xOc6H5c6HcT66vlmrOUeRUq0KtyH7xOc6H5c6H9:RIS434enaKe/aKe/aKe/a

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks