Overview

overview

10

Static

static

8bcd2abfdb...62.exe

windows7-x64

10

8bcd2abfdb...62.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bcd2abfdbfb81ef83a2f9ddeff8435c0859d7cfdaa5eae713aaafd2c3e50a62

  • Size

    270KB

  • Sample

    221201-1bf3bsfg8x

  • MD5

    4dc6b295f511b1d20210a010af219c54

  • SHA1

    465ea521f034b644a2c2b851c7c883281dbbc314

  • SHA256

    8bcd2abfdbfb81ef83a2f9ddeff8435c0859d7cfdaa5eae713aaafd2c3e50a62

  • SHA512

    f58eb03b275d403d71295a9ac45fad17850d8379e9f614ec1c95460248ac45c38859ffd565d69b2bed3778a265223bd8ed8c323eb10706f08a8aa99ba09e2c1c

  • SSDEEP

    3072:UiyVDxC5Vp6fh708kDc90/MnLkGpNo4qs+NA6aXwReB22Mil8j20siIChKo:UfVD6Vpm9NPBNo2rp22N8i0siVhKo

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      8bcd2abfdbfb81ef83a2f9ddeff8435c0859d7cfdaa5eae713aaafd2c3e50a62

    • Size

      270KB

    • MD5

      4dc6b295f511b1d20210a010af219c54

    • SHA1

      465ea521f034b644a2c2b851c7c883281dbbc314

    • SHA256

      8bcd2abfdbfb81ef83a2f9ddeff8435c0859d7cfdaa5eae713aaafd2c3e50a62

    • SHA512

      f58eb03b275d403d71295a9ac45fad17850d8379e9f614ec1c95460248ac45c38859ffd565d69b2bed3778a265223bd8ed8c323eb10706f08a8aa99ba09e2c1c

    • SSDEEP

      3072:UiyVDxC5Vp6fh708kDc90/MnLkGpNo4qs+NA6aXwReB22Mil8j20siIChKo:UfVD6Vpm9NPBNo2rp22N8i0siVhKo

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks