Overview

overview

10

Static

static

10

37a00a3e1b...d6.exe

windows7-x64

10

37a00a3e1b...d6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37a00a3e1bd9b6fec98c51ffe0777eebac65496e4713850285a17e701454cbd6

  • Size

    288KB

  • Sample

    240424-zdscpshc48

  • MD5

    dc34f6c86f7180e382216f5f5985067a

  • SHA1

    dc668963f1de7c7ea076136f5d224f6c5a0b0fa9

  • SHA256

    37a00a3e1bd9b6fec98c51ffe0777eebac65496e4713850285a17e701454cbd6

  • SHA512

    be7f28f6d1bb813abdc95d7ac5af2b247f99f0ec9d266ebf63c00952da3aaf4447ea4c6f90da6a0fe6538ef6fbbe42dc1330e59941cea21ede76e99e8830aa99

  • SSDEEP

    6144:k9Zb1xPF+vdvvxh6Z0fzVIajNDwKhnVxW:y1xPF+vdvv/20fhISKynVxW

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      37a00a3e1bd9b6fec98c51ffe0777eebac65496e4713850285a17e701454cbd6

    • Size

      288KB

    • MD5

      dc34f6c86f7180e382216f5f5985067a

    • SHA1

      dc668963f1de7c7ea076136f5d224f6c5a0b0fa9

    • SHA256

      37a00a3e1bd9b6fec98c51ffe0777eebac65496e4713850285a17e701454cbd6

    • SHA512

      be7f28f6d1bb813abdc95d7ac5af2b247f99f0ec9d266ebf63c00952da3aaf4447ea4c6f90da6a0fe6538ef6fbbe42dc1330e59941cea21ede76e99e8830aa99

    • SSDEEP

      6144:k9Zb1xPF+vdvvxh6Z0fzVIajNDwKhnVxW:y1xPF+vdvv/20fhISKynVxW

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks