Overview

overview

10

Static

static

10

b07dd1892f...f7.exe

windows7-x64

10

b07dd1892f...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b07dd1892fabf587f62b41fd91d55fbf029d45fd739afa3233a1c70d07d426f7

  • Size

    2.7MB

  • Sample

    221202-r18n7sbf4t

  • MD5

    5a97c5d2dd00f357fb03f0caf1c553b1

  • SHA1

    a2fb0f51a5ab54a4d702938aad82fdc3eaf6e38a

  • SHA256

    b07dd1892fabf587f62b41fd91d55fbf029d45fd739afa3233a1c70d07d426f7

  • SHA512

    2786a3f889d7dfe2488b19de6914711c742ec45ce99c71973e73880bcf22919fd18eb058531c82f73a5645f4b9971dcf496cf693ff1a114fd58c5c80bb8dc32f

  • SSDEEP

    49152:u2Q5CZXS4e4jlb2rK/X7xVuxl9p9s13vlX5cNTlhjSF4nBLU6UIpbHLDil0/o4dx:c5eS1WbiKf7vGfCfp5cNJhjvnBQIp3DW

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      b07dd1892fabf587f62b41fd91d55fbf029d45fd739afa3233a1c70d07d426f7

    • Size

      2.7MB

    • MD5

      5a97c5d2dd00f357fb03f0caf1c553b1

    • SHA1

      a2fb0f51a5ab54a4d702938aad82fdc3eaf6e38a

    • SHA256

      b07dd1892fabf587f62b41fd91d55fbf029d45fd739afa3233a1c70d07d426f7

    • SHA512

      2786a3f889d7dfe2488b19de6914711c742ec45ce99c71973e73880bcf22919fd18eb058531c82f73a5645f4b9971dcf496cf693ff1a114fd58c5c80bb8dc32f

    • SSDEEP

      49152:u2Q5CZXS4e4jlb2rK/X7xVuxl9p9s13vlX5cNTlhjSF4nBLU6UIpbHLDil0/o4dx:c5eS1WbiKf7vGfCfp5cNJhjvnBQIp3DW

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks