Overview

overview

10

Static

static

74a98f366c...c1.exe

windows7-x64

10

74a98f366c...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74a98f366ccd69989b183da186a7b0cd9b03c29f1339a280aa61a5a9a93186c1

  • Size

    1.1MB

  • Sample

    221130-avwn1sff41

  • MD5

    046191913eea2c1cddc48701553c8e09

  • SHA1

    263e329296a3bd56c07111f1c584ae0c3ac2c969

  • SHA256

    74a98f366ccd69989b183da186a7b0cd9b03c29f1339a280aa61a5a9a93186c1

  • SHA512

    819a661e170746f7e585146ea97eb9e0df95e88292d651805cbe0acd0053448b628b434531edb19e69718e61b8ecc3e42dbe1de8fe5533cb176d523c7e8452b7

  • SSDEEP

    24576:GEVdWKs0KRLZQ22Z5SEaa2Hm58axYFIxIWqH5E:GsctRL2JZ5p58axYFIxIa

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      74a98f366ccd69989b183da186a7b0cd9b03c29f1339a280aa61a5a9a93186c1

    • Size

      1.1MB

    • MD5

      046191913eea2c1cddc48701553c8e09

    • SHA1

      263e329296a3bd56c07111f1c584ae0c3ac2c969

    • SHA256

      74a98f366ccd69989b183da186a7b0cd9b03c29f1339a280aa61a5a9a93186c1

    • SHA512

      819a661e170746f7e585146ea97eb9e0df95e88292d651805cbe0acd0053448b628b434531edb19e69718e61b8ecc3e42dbe1de8fe5533cb176d523c7e8452b7

    • SSDEEP

      24576:GEVdWKs0KRLZQ22Z5SEaa2Hm58axYFIxIWqH5E:GsctRL2JZ5p58axYFIxIa

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks