General
- Target 4f57df5fe1ce4b9f041df491749bbe753413532f5b3ad1bebde0dde875c8e1d8_malware.exe
- Size 1.6MB
- Sample221213-kkcs9sec82
- SHA256 4f57df5fe1ce4b9f041df491749bbe753413532f5b3ad1bebde0dde875c8e1d8
Score
10/10
Malware Config
Targets
-
- Target 4f57df5fe1ce4b9f041df491749bbe753413532f5b3ad1bebde0dde875c8e1d8_malware.exe
- Size 1.6MB
- SHA256 4f57df5fe1ce4b9f041df491749bbe753413532f5b3ad1bebde0dde875c8e1d8
Score10/10-
Detect Neshta payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.