Overview

overview

10

Static

static

64ad8e54a3...7d.exe

windows7-x64

10

64ad8e54a3...7d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    64ad8e54a3c656f727c41567c6cae451e013f0ad26b99831dcb530d07b14587d

  • Size

    279KB

  • Sample

    221204-c2v26shh42

  • MD5

    0370e29985021d83df598d5578e9c45e

  • SHA1

    7818f3883878af9c23d3341ca08ec1d74428f48f

  • SHA256

    64ad8e54a3c656f727c41567c6cae451e013f0ad26b99831dcb530d07b14587d

  • SHA512

    8a94b86f878a1c8bbb19c1eafac3d3d7fc99d2d3519a51b3f8cc541c05123f1edf0beb8ae98c3a12a2e879a278b77780fdd1fe001ea72f6db426dc1e1bd143a5

  • SSDEEP

    6144:tuOdfqavhGrv5/VZg+UPjDi61Lvzg/PbIh0:9vhG75/b1UvPvUjIh0

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      64ad8e54a3c656f727c41567c6cae451e013f0ad26b99831dcb530d07b14587d

    • Size

      279KB

    • MD5

      0370e29985021d83df598d5578e9c45e

    • SHA1

      7818f3883878af9c23d3341ca08ec1d74428f48f

    • SHA256

      64ad8e54a3c656f727c41567c6cae451e013f0ad26b99831dcb530d07b14587d

    • SHA512

      8a94b86f878a1c8bbb19c1eafac3d3d7fc99d2d3519a51b3f8cc541c05123f1edf0beb8ae98c3a12a2e879a278b77780fdd1fe001ea72f6db426dc1e1bd143a5

    • SSDEEP

      6144:tuOdfqavhGrv5/VZg+UPjDi61Lvzg/PbIh0:9vhG75/b1UvPvUjIh0

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks