Overview

overview

10

Static

static

10

27547c25df...94.exe

windows7-x64

10

27547c25df...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f816da07944cce87c31e46de91a3e6b4aba0d9f389322351a2968db7edae36c

  • Size

    25KB

  • Sample

    240419-wyfymabg62

  • MD5

    88a4d6dd66a30fb498e3ad8f2a3c91c2

  • SHA1

    16d2713da480b509cd02431707f197be0eae7f2b

  • SHA256

    1f816da07944cce87c31e46de91a3e6b4aba0d9f389322351a2968db7edae36c

  • SHA512

    20c372eaf463fad736afde7d6c6192229230df9edd9715d4f17915cba0cdf9b780e32e15a00e27361bd89f301180cc02e471315c0c9e7c72794299e6056fd01a

  • SSDEEP

    384:LX744GYMiWeVtQXB3yFsZ2bo2YHnb3tLke7SjbTT2L127Hps22qqGRcQl2c69R86:n49iWe38B3QY2boZb3yf2eJTqucQl2Nf

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      27547c25df82ea051b50dc76a2d4d9a26c24b5e41596beadeca70e85ffe78694

    • Size

      40KB

    • MD5

      cbe294bac1705f30ffa7f75e1d05354e

    • SHA1

      6d4fb11860408045d7d683b250b3f8c2738fae78

    • SHA256

      27547c25df82ea051b50dc76a2d4d9a26c24b5e41596beadeca70e85ffe78694

    • SHA512

      3690de1ddfd74e8d28c890f0ed586e59f2d2e74fad92cf3b16824ad9ded1d0c55ee5e78118b0a00b19ab6a4befa13aad2cacb0be7f6971a01190a168a07985e2

    • SSDEEP

      768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ187RJ:JxqjQ+P04wsmJCJ7RJ

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks