Overview

overview

10

Static

static

10

1861ade663...2a.exe

windows7-x64

10

1861ade663...2a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1861ade663893cedf8c9bfbfbb397220dec8cbc0bf7773c4a042d0bab07d5f2a

  • Size

    226KB

  • Sample

    221202-r228tabf9z

  • MD5

    26be89e7461f820c28e795f15875c400

  • SHA1

    f2a7c70b98993aa889a7accc7fa8945238f11357

  • SHA256

    1861ade663893cedf8c9bfbfbb397220dec8cbc0bf7773c4a042d0bab07d5f2a

  • SHA512

    31793a5864b107f293f2496ec85221a39db013b917a074f8289f6cec69b8d44b0985ca8c50a0098c020ff8cbf36bc2ae1a827dfddd158592b47554c3f847d455

  • SSDEEP

    6144:k9HbFePeusvLtNt+00ZSHgche6HR3kk0uX:8eHKBNt+xSpXx3kmX

Score
10/10
neshtaevasionpersistencespywarestealer

Malware Config

Targets

    • Target

      1861ade663893cedf8c9bfbfbb397220dec8cbc0bf7773c4a042d0bab07d5f2a

    • Size

      226KB

    • MD5

      26be89e7461f820c28e795f15875c400

    • SHA1

      f2a7c70b98993aa889a7accc7fa8945238f11357

    • SHA256

      1861ade663893cedf8c9bfbfbb397220dec8cbc0bf7773c4a042d0bab07d5f2a

    • SHA512

      31793a5864b107f293f2496ec85221a39db013b917a074f8289f6cec69b8d44b0985ca8c50a0098c020ff8cbf36bc2ae1a827dfddd158592b47554c3f847d455

    • SSDEEP

      6144:k9HbFePeusvLtNt+00ZSHgche6HR3kk0uX:8eHKBNt+xSpXx3kmX

    Score
    10/10
    neshtaevasionpersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks