General

  • Target

    84de58c381e467443a89d80dd301984f4e186bf50a568beb8bd9f7908f78399c

  • Size

    112KB

  • Sample

    221202-r2ms5abf6x

  • MD5

    849f682f8dc56321ed3920d21f778aa3

  • SHA1

    622f7d7c516b269e7f0fa3b5e751b3c9f1b9d2f5

  • SHA256

    84de58c381e467443a89d80dd301984f4e186bf50a568beb8bd9f7908f78399c

  • SHA512

    53f14367cee1fcfc24c82e64f5497a2f912ac7b3b6c5d1dbab506175416ae20d0ba34fce051fc59796c7fc9f48b7b40295109f6b755b62f11b7a1d7f2f85c596

  • SSDEEP

    1536:JxqjQ+P04wsmJCatNYYYYtz74hh5DGATwm4da5SZqKiJoqVh:sr85CatNYYYYtz+5rTwmrNhXh

Malware Config

Targets

    • Target

      84de58c381e467443a89d80dd301984f4e186bf50a568beb8bd9f7908f78399c

    • Size

      112KB

    • MD5

      849f682f8dc56321ed3920d21f778aa3

    • SHA1

      622f7d7c516b269e7f0fa3b5e751b3c9f1b9d2f5

    • SHA256

      84de58c381e467443a89d80dd301984f4e186bf50a568beb8bd9f7908f78399c

    • SHA512

      53f14367cee1fcfc24c82e64f5497a2f912ac7b3b6c5d1dbab506175416ae20d0ba34fce051fc59796c7fc9f48b7b40295109f6b755b62f11b7a1d7f2f85c596

    • SSDEEP

      1536:JxqjQ+P04wsmJCatNYYYYtz74hh5DGATwm4da5SZqKiJoqVh:sr85CatNYYYYtz+5rTwmrNhXh

    • Detect Neshta payload

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks