Overview

overview

10

Static

static

10

bc40e3f1fb...59.exe

windows7-x64

10

bc40e3f1fb...59.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc40e3f1fb1f7f7aba4e242cb4d081fc2d166a2e25abb69480e76258a5fbf759

  • Size

    1.3MB

  • Sample

    221202-hl8wzscg35

  • MD5

    87cc0f6ac16b1df8fae64d3943e4b4ee

  • SHA1

    21a8a3d20b96e0987bef9fd1df7276c41a54e0bf

  • SHA256

    bc40e3f1fb1f7f7aba4e242cb4d081fc2d166a2e25abb69480e76258a5fbf759

  • SHA512

    3c0e64916bc87b159eedd24ab114441253a48033c7e43c7f1ee0aaa47c5f68afc4cf4ef80b47fb05bdc1eddb0f5e1440d40d7cb6657bf42b4e4e3c237712ec42

  • SSDEEP

    24576:zfKgZKAwnymigBIGaY+bu5WGhwZxowrZ4TEICihI9wSPmUUevxQ2FqSZd6Rlwx9V:zfsqpLbqkN4U+I9wC8ev28Zd6Ry

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      bc40e3f1fb1f7f7aba4e242cb4d081fc2d166a2e25abb69480e76258a5fbf759

    • Size

      1.3MB

    • MD5

      87cc0f6ac16b1df8fae64d3943e4b4ee

    • SHA1

      21a8a3d20b96e0987bef9fd1df7276c41a54e0bf

    • SHA256

      bc40e3f1fb1f7f7aba4e242cb4d081fc2d166a2e25abb69480e76258a5fbf759

    • SHA512

      3c0e64916bc87b159eedd24ab114441253a48033c7e43c7f1ee0aaa47c5f68afc4cf4ef80b47fb05bdc1eddb0f5e1440d40d7cb6657bf42b4e4e3c237712ec42

    • SSDEEP

      24576:zfKgZKAwnymigBIGaY+bu5WGhwZxowrZ4TEICihI9wSPmUUevxQ2FqSZd6Rlwx9V:zfsqpLbqkN4U+I9wC8ev28Zd6Ry

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks