General

  • Target

    3658d8255f6b3259d695673e3f248faed7db03efdc4aa08326315bec41faaacf

  • Size

    116KB

  • Sample

    221202-r21d8aga86

  • MD5

    1f6d494a421f5f1a89cd634df1a2eb80

  • SHA1

    344ab8c1b1a9cffa656c1c8ab21cc8ca64501784

  • SHA256

    3658d8255f6b3259d695673e3f248faed7db03efdc4aa08326315bec41faaacf

  • SHA512

    b70febaf565a127116ac3984ab464a05e3b0049a95df3c5daa7436ae5b1b41360debd200d36374820c6505f996bdfbbb1b1003bae92ea60ac870248f05572711

  • SSDEEP

    1536:JxqjQ+P04wsmJCEs2XVhsjdN+jOx6x/gjb2xFQN:sr85CIXV6jijOYEb2xFQN

Malware Config

Targets

    • Target

      3658d8255f6b3259d695673e3f248faed7db03efdc4aa08326315bec41faaacf

    • Size

      116KB

    • MD5

      1f6d494a421f5f1a89cd634df1a2eb80

    • SHA1

      344ab8c1b1a9cffa656c1c8ab21cc8ca64501784

    • SHA256

      3658d8255f6b3259d695673e3f248faed7db03efdc4aa08326315bec41faaacf

    • SHA512

      b70febaf565a127116ac3984ab464a05e3b0049a95df3c5daa7436ae5b1b41360debd200d36374820c6505f996bdfbbb1b1003bae92ea60ac870248f05572711

    • SSDEEP

      1536:JxqjQ+P04wsmJCEs2XVhsjdN+jOx6x/gjb2xFQN:sr85CIXV6jijOYEb2xFQN

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Tasks