Overview

overview

10

Static

static

10

b260007317...bf.exe

windows7-x64

10

b260007317...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b26000731710b91b020a96c2c834e609f3f74d1b4c879964e1962c69975e3fbf

  • Size

    154KB

  • Sample

    221202-r16vlsbf3w

  • MD5

    f53d031893900a221a023dcecf635c5e

  • SHA1

    46301cd53556d3348221fccd536cbfddbeb0317f

  • SHA256

    b26000731710b91b020a96c2c834e609f3f74d1b4c879964e1962c69975e3fbf

  • SHA512

    b4a64cb0eb75060510408d1b024af865c498cb3c799d8343917b554048f4791653a7a6fe3c2dc0c44fd27d2deb6437f40d63576daf200e33097a2085c3fd836c

  • SSDEEP

    3072:sr8JCtz5RI+FlB6MfXhaYf+YC/A114IV71h7rNIVCTXA3eZIkesJPPqb5g+VTjKD:ktxI+TLbx

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      b26000731710b91b020a96c2c834e609f3f74d1b4c879964e1962c69975e3fbf

    • Size

      154KB

    • MD5

      f53d031893900a221a023dcecf635c5e

    • SHA1

      46301cd53556d3348221fccd536cbfddbeb0317f

    • SHA256

      b26000731710b91b020a96c2c834e609f3f74d1b4c879964e1962c69975e3fbf

    • SHA512

      b4a64cb0eb75060510408d1b024af865c498cb3c799d8343917b554048f4791653a7a6fe3c2dc0c44fd27d2deb6437f40d63576daf200e33097a2085c3fd836c

    • SSDEEP

      3072:sr8JCtz5RI+FlB6MfXhaYf+YC/A114IV71h7rNIVCTXA3eZIkesJPPqb5g+VTjKD:ktxI+TLbx

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks