Overview

overview

10

Static

static

5987a4118d...2e.exe

windows7-x64

10

5987a4118d...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e

  • Size

    902KB

  • Sample

    221130-av2v2aff6s

  • MD5

    7273f96026f41369b913b5dc2d67c0d1

  • SHA1

    7bd31f125fea63b71e7c489bcf5b79297b1deaff

  • SHA256

    5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e

  • SHA512

    9e0b5b36122d88326c6070d68aff537015802005041815d6510f68c176eaeae44356e101d67dca337d0aab836cb6d15202bd13451880f9ffef0e04abb77f37aa

  • SSDEEP

    24576:bTBed//xueiltlf4rHqVLL66VoGFU1m4:b4d/ZueiltOrHav6KoGF

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e

    • Size

      902KB

    • MD5

      7273f96026f41369b913b5dc2d67c0d1

    • SHA1

      7bd31f125fea63b71e7c489bcf5b79297b1deaff

    • SHA256

      5987a4118d2299962fcd2919e14bd1937e5d5d5011475849887c4ee7b8acdb2e

    • SHA512

      9e0b5b36122d88326c6070d68aff537015802005041815d6510f68c176eaeae44356e101d67dca337d0aab836cb6d15202bd13451880f9ffef0e04abb77f37aa

    • SSDEEP

      24576:bTBed//xueiltlf4rHqVLL66VoGFU1m4:b4d/ZueiltOrHav6KoGF

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks