Overview

overview

10

Static

static

10

f9e9e7c048...ac.exe

windows7-x64

10

f9e9e7c048...ac.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48a990e5cb82884fdf556d101952e42014c53f69a4b8b5cf860eda027a8212b4

  • Size

    281KB

  • Sample

    240417-p26vwsfh39

  • MD5

    fbc17fc1f323f5fd176216d7b92f1463

  • SHA1

    a2b0a039f163f989e04c4553c26047e0c6fd2ca6

  • SHA256

    48a990e5cb82884fdf556d101952e42014c53f69a4b8b5cf860eda027a8212b4

  • SHA512

    e8ac7e9e6e6c6bfe43215588a7c14f3eb013d224b935246c4ad70e85e87bd55e8d90e933689b63061a83f5cd19b5ee4c313e871b93a17518828902d727ce6b24

  • SSDEEP

    6144:pAS3EMjGNaIeM6bSLD+taJdvmQU3lzTAR+0GYsRntvGIeYXOE4:pZh+anM6brQJQQiSCYsRtvGnIOF

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      f9e9e7c0480f96386969fd01fb31601e95fac8d2d7e7c07f04a7ea9522c2efac.exe

    • Size

      572KB

    • MD5

      b93d95271dbef3398cbedc69f0569e0c

    • SHA1

      fded27f9d463776c4747c019a5e91dcbb2915213

    • SHA256

      f9e9e7c0480f96386969fd01fb31601e95fac8d2d7e7c07f04a7ea9522c2efac

    • SHA512

      48b1c42ead2b322475cc3f6abb707a73440dece53596a355a90ed4f48b33673dbf38d9cca338fed11fef2ef7810bc9c663966042e6f51649f5a7b95723846a32

    • SSDEEP

      6144:k969DEsaVheNSPUP7focas490uM9W9N9N9P9P9P9:Johe+Ub/J

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks