Overview

overview

10

Static

static

10

1e0e94d942...6d.exe

windows7-x64

10

1e0e94d942...6d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e0e94d942640944f0495a497585e041e06fc9b48febee9a9e0617c34283a46d

  • Size

    340KB

  • Sample

    221202-r22maaga92

  • MD5

    42aea131431fd7f6a33c3a105da8c150

  • SHA1

    4b8248bbcbdcd6daafd62447c8904ec0d3812bb5

  • SHA256

    1e0e94d942640944f0495a497585e041e06fc9b48febee9a9e0617c34283a46d

  • SHA512

    c9da91a4549c0086bd1f96fe55450f851eb238c3a5b3b678c795cf84b9a9c55c537989d0f9c703be0edcd78d71096baa8cbb7c4fb65977d2e2a62519d1a58554

  • SSDEEP

    6144:k9h6qCoGSbH33BVGxYxZFRhw0XZNQ5GHeMcXKKs+eV4z4wY4ZPg0EPGMgN/zx:2C/STh8xY3h3Jm5Gq6oeV44T4C0EPXgb

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      1e0e94d942640944f0495a497585e041e06fc9b48febee9a9e0617c34283a46d

    • Size

      340KB

    • MD5

      42aea131431fd7f6a33c3a105da8c150

    • SHA1

      4b8248bbcbdcd6daafd62447c8904ec0d3812bb5

    • SHA256

      1e0e94d942640944f0495a497585e041e06fc9b48febee9a9e0617c34283a46d

    • SHA512

      c9da91a4549c0086bd1f96fe55450f851eb238c3a5b3b678c795cf84b9a9c55c537989d0f9c703be0edcd78d71096baa8cbb7c4fb65977d2e2a62519d1a58554

    • SSDEEP

      6144:k9h6qCoGSbH33BVGxYxZFRhw0XZNQ5GHeMcXKKs+eV4z4wY4ZPg0EPGMgN/zx:2C/STh8xY3h3Jm5Gq6oeV44T4C0EPXgb

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks