Overview

overview

10

Static

static

10

9880eead08...03.exe

windows7-x64

10

9880eead08...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03

  • Size

    812KB

  • Sample

    221202-r2gbcaga56

  • MD5

    a68ac326894a3d62dfc171d8eb6da09e

  • SHA1

    0868af8f604f4f3a421f4c5d324e7ca2a4d69a29

  • SHA256

    9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03

  • SHA512

    1e70876efc3a3122626ef18d8f1da948286066d96956bc8628cc2a373e1552ce71e2992ace68241a6cd5d160edc02d2541d82ee3e4be376ca1c376d1a11eb3c6

  • SSDEEP

    24576:cizlBXw7GFa0rgCWuH1FWV1JboJvjAvjcvjf:FBXlCUh

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03

    • Size

      812KB

    • MD5

      a68ac326894a3d62dfc171d8eb6da09e

    • SHA1

      0868af8f604f4f3a421f4c5d324e7ca2a4d69a29

    • SHA256

      9880eead082d56cf61fa8a999a9956debb4b0cc18a41f6fde15bb2d445fcfb03

    • SHA512

      1e70876efc3a3122626ef18d8f1da948286066d96956bc8628cc2a373e1552ce71e2992ace68241a6cd5d160edc02d2541d82ee3e4be376ca1c376d1a11eb3c6

    • SSDEEP

      24576:cizlBXw7GFa0rgCWuH1FWV1JboJvjAvjcvjf:FBXlCUh

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks