Overview

overview

10

Static

static

3

Genalf.exe

windows10-2004-x64

10

Resubmissions

22-07-2023 16:58

230722-vg51rabe85 10

22-07-2023 16:54

230722-vemrdsbe78 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Genalf.exe

  • Size

    4.4MB

  • Sample

    230722-vemrdsbe78

  • MD5

    859548a7f3a98727f5d07f82e53b3973

  • SHA1

    f86c376661bd7d15d2ef663ac94990f72255ee8e

  • SHA256

    f395924891b51c1131ea1f3b27cacd12ab52bbb63a1ee6b2d380f6f6db238510

  • SHA512

    d0f4c667bc019b568eec09f7db930c0c3763594225a8ddc741c3a52d692a48942162bc6a7c0622ec966916407496d37f42f10baa82320da8d275230d1e481b72

  • SSDEEP

    98304:f9QSpqvxZ6PghB4/ErFi244Nqk9Ht15Uwe6zEPxhBgu4IGvzm:fTqpZ6PuB4/EJiT4NJN12UgP4I

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      Genalf.exe

    • Size

      4.4MB

    • MD5

      859548a7f3a98727f5d07f82e53b3973

    • SHA1

      f86c376661bd7d15d2ef663ac94990f72255ee8e

    • SHA256

      f395924891b51c1131ea1f3b27cacd12ab52bbb63a1ee6b2d380f6f6db238510

    • SHA512

      d0f4c667bc019b568eec09f7db930c0c3763594225a8ddc741c3a52d692a48942162bc6a7c0622ec966916407496d37f42f10baa82320da8d275230d1e481b72

    • SSDEEP

      98304:f9QSpqvxZ6PghB4/ErFi244Nqk9Ht15Uwe6zEPxhBgu4IGvzm:fTqpZ6PuB4/EJiT4NJN12UgP4I

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks