Overview

overview

10

Static

static

10

704e6e2478...cb.exe

windows7-x64

10

704e6e2478...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    704e6e24784aee41d1fd2d255c4b8abf777a9ce3858e2bbceedfcae12e0bb1cb

  • Size

    168KB

  • Sample

    221202-r2we9sga78

  • MD5

    824b2c8c99e2c76c17623d9beb5d8d00

  • SHA1

    4ddb8eef902fee2d00a36165ecd39767f6205518

  • SHA256

    704e6e24784aee41d1fd2d255c4b8abf777a9ce3858e2bbceedfcae12e0bb1cb

  • SHA512

    a5d7a501eaed3d1256f5a2ee5d00bddd7036f9e4ee3ab2fff95db3c8fa68183e2d4601d17435462287a41ed4ef9e85e0ba61eccf969d2cac31e0735ca053ee38

  • SSDEEP

    3072:sr85CLxUuAvVEABcKQwWDlPiVFcKQwWDlPiVi:k9Lx56cKRWBPiVFcKRWBPiVi

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      704e6e24784aee41d1fd2d255c4b8abf777a9ce3858e2bbceedfcae12e0bb1cb

    • Size

      168KB

    • MD5

      824b2c8c99e2c76c17623d9beb5d8d00

    • SHA1

      4ddb8eef902fee2d00a36165ecd39767f6205518

    • SHA256

      704e6e24784aee41d1fd2d255c4b8abf777a9ce3858e2bbceedfcae12e0bb1cb

    • SHA512

      a5d7a501eaed3d1256f5a2ee5d00bddd7036f9e4ee3ab2fff95db3c8fa68183e2d4601d17435462287a41ed4ef9e85e0ba61eccf969d2cac31e0735ca053ee38

    • SSDEEP

      3072:sr85CLxUuAvVEABcKQwWDlPiVFcKQwWDlPiVi:k9Lx56cKRWBPiVFcKRWBPiVi

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks