Overview

overview

10

Static

static

10

8181ee9f2f...e3.exe

windows7-x64

10

8181ee9f2f...e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8181ee9f2f9dfbafca606440b9e0a141855d4951c76a4655762e804bd0305de3

  • Size

    117KB

  • Sample

    221202-r2pygsbf61

  • MD5

    936db265d0cc43bb03032816789fcbf9

  • SHA1

    5223a8bad8968d4ebebef23428f18223fdd38944

  • SHA256

    8181ee9f2f9dfbafca606440b9e0a141855d4951c76a4655762e804bd0305de3

  • SHA512

    48942b1d8edcb91cfc3383bcb18f08af6ebaa956dda58e076f9d5b5f03efae3e363a33fc7208a7b465e234fe7aae22a027402fe234f60750bc1564d226f84d7e

  • SSDEEP

    1536:JxqjQ+P04wsmJC1I0fqQ5OGR4CaxWJJ0/bgBgvTh26QshXaE0g:sr85C1zfTOG0xgsb7d26QshX5

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      8181ee9f2f9dfbafca606440b9e0a141855d4951c76a4655762e804bd0305de3

    • Size

      117KB

    • MD5

      936db265d0cc43bb03032816789fcbf9

    • SHA1

      5223a8bad8968d4ebebef23428f18223fdd38944

    • SHA256

      8181ee9f2f9dfbafca606440b9e0a141855d4951c76a4655762e804bd0305de3

    • SHA512

      48942b1d8edcb91cfc3383bcb18f08af6ebaa956dda58e076f9d5b5f03efae3e363a33fc7208a7b465e234fe7aae22a027402fe234f60750bc1564d226f84d7e

    • SSDEEP

      1536:JxqjQ+P04wsmJC1I0fqQ5OGR4CaxWJJ0/bgBgvTh26QshXaE0g:sr85C1zfTOG0xgsb7d26QshX5

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks