Overview

overview

10

Static

static

10

778ed8a312...a0.exe

windows7-x64

10

778ed8a312...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    778ed8a312ce13a3fb06c53e9372f71ed2e0092b5888c61e559eb096f81921a0

  • Size

    214KB

  • Sample

    221130-avt57aff4z

  • MD5

    0fb0c9a4b17b90822702d53c0dc102e1

  • SHA1

    b7ccff5efe979022171466c0779b2b8d946f4bac

  • SHA256

    778ed8a312ce13a3fb06c53e9372f71ed2e0092b5888c61e559eb096f81921a0

  • SHA512

    e5dd4d516451ffafdb0141b1076b6c0c4f5a5ed7109c4d8e3df431eb90724623f0fdb6460ee5b2694a6d730abe4e5be95529217ab9a14d5a63ade3eade368ce7

  • SSDEEP

    6144:k9JeKBw8v92A7BB8jEvTIh/JhdTGlx1LX:e1Bv/8jEUh/pI17

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      778ed8a312ce13a3fb06c53e9372f71ed2e0092b5888c61e559eb096f81921a0

    • Size

      214KB

    • MD5

      0fb0c9a4b17b90822702d53c0dc102e1

    • SHA1

      b7ccff5efe979022171466c0779b2b8d946f4bac

    • SHA256

      778ed8a312ce13a3fb06c53e9372f71ed2e0092b5888c61e559eb096f81921a0

    • SHA512

      e5dd4d516451ffafdb0141b1076b6c0c4f5a5ed7109c4d8e3df431eb90724623f0fdb6460ee5b2694a6d730abe4e5be95529217ab9a14d5a63ade3eade368ce7

    • SSDEEP

      6144:k9JeKBw8v92A7BB8jEvTIh/JhdTGlx1LX:e1Bv/8jEUh/pI17

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks