Overview

overview

10

Static

static

10

WinPcap_4_1_3.exe

windows7-x64

10

WinPcap_4_1_3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    WinPcap_4_1_3.exe

  • Size

    934KB

  • Sample

    231230-fcntcafdcn

  • MD5

    85b16d28fbf119822f9d280610ee1118

  • SHA1

    d477c9bb2f66930e045035f9ffaa5e306aa13461

  • SHA256

    32b2ec670b0977b71792d2172d5e91143fcd6239a77a7b59dad7c94673e676dc

  • SHA512

    68a4faef45b92c295c04865dc1452c8d574063946e5a0e91b606cbfbc6ecae63ebf06a603a7a8dbca0a125e2a32b0cbbbe0aa30a0cac7d9ff63723389d76cd08

  • SSDEEP

    24576:WiOldyR6ORWsaM2QROxa6jsqUENfJjNK/CG6niqi+k:3KzqWsayROxa6QDENuaG+ifP

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      WinPcap_4_1_3.exe

    • Size

      934KB

    • MD5

      85b16d28fbf119822f9d280610ee1118

    • SHA1

      d477c9bb2f66930e045035f9ffaa5e306aa13461

    • SHA256

      32b2ec670b0977b71792d2172d5e91143fcd6239a77a7b59dad7c94673e676dc

    • SHA512

      68a4faef45b92c295c04865dc1452c8d574063946e5a0e91b606cbfbc6ecae63ebf06a603a7a8dbca0a125e2a32b0cbbbe0aa30a0cac7d9ff63723389d76cd08

    • SSDEEP

      24576:WiOldyR6ORWsaM2QROxa6jsqUENfJjNK/CG6niqi+k:3KzqWsayROxa6QDENuaG+ifP

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks