Overview

overview

10

Static

static

10

43b3f4a272...e2.exe

windows7-x64

10

43b3f4a272...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43b3f4a272bce5f11eea72d371e3f541d8a984eb33e9a9af156e0ad5af4f53e2

  • Size

    733KB

  • Sample

    240326-x9me8aad28

  • MD5

    f913d80a72f4a9a301105ff057784da3

  • SHA1

    b0e7f8190834d87545fc72b7eb15468cb946e67c

  • SHA256

    43b3f4a272bce5f11eea72d371e3f541d8a984eb33e9a9af156e0ad5af4f53e2

  • SHA512

    5fc105986c306b5ec6d4c622b312d8c6d7fcced826a13a09f25cdf259cccd4e3d04b25203335e0d5c8a78dae49e7eb346fb0c48c7aca34e842c0f4e639db5926

  • SSDEEP

    12288:WB3g+VaUBLHZ/sME8z76w/t3Z/gMj8zh6w/q:MwpUB7ZE66gBZ4h6gq

Score
10/10
neshtarevengeratpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      43b3f4a272bce5f11eea72d371e3f541d8a984eb33e9a9af156e0ad5af4f53e2

    • Size

      733KB

    • MD5

      f913d80a72f4a9a301105ff057784da3

    • SHA1

      b0e7f8190834d87545fc72b7eb15468cb946e67c

    • SHA256

      43b3f4a272bce5f11eea72d371e3f541d8a984eb33e9a9af156e0ad5af4f53e2

    • SHA512

      5fc105986c306b5ec6d4c622b312d8c6d7fcced826a13a09f25cdf259cccd4e3d04b25203335e0d5c8a78dae49e7eb346fb0c48c7aca34e842c0f4e639db5926

    • SSDEEP

      12288:WB3g+VaUBLHZ/sME8z76w/t3Z/gMj8zh6w/q:MwpUB7ZE66gBZ4h6gq

    Score
    10/10
    neshtarevengeratpersistencespywarestealertrojan

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks