Overview

overview

10

Static

static

10

2024-04-30...os.exe

windows7-x64

10

2024-04-30...os.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-30_d6da671d1cb0a8be4874d9fb19f40ab3_neshta_phobos

  • Size

    98KB

  • Sample

    240430-2prawsbe47

  • MD5

    d6da671d1cb0a8be4874d9fb19f40ab3

  • SHA1

    f74cfb8aa156be19d8ecf862b7f4563363725436

  • SHA256

    4e30f39ae6e696ed5ef6dd57a5144bcfde73bea5604179db13da438a33880bd2

  • SHA512

    58230fd980e814c77d6c0553c23a9fc3ce02e21dca049d7b56267b6df4acb705cddba5bab1bab60a3b94effc71ca0aaf3982446b2c90cc747f4008f7b5468485

  • SSDEEP

    1536:JxqjQ+P04wsmJCpEEt4AwMEz9UQz0QNeRBl5PT/rx1mzwRMSTdLpJPs:sr85Cn45MEyQ5QRrmzwR5Jk

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      2024-04-30_d6da671d1cb0a8be4874d9fb19f40ab3_neshta_phobos

    • Size

      98KB

    • MD5

      d6da671d1cb0a8be4874d9fb19f40ab3

    • SHA1

      f74cfb8aa156be19d8ecf862b7f4563363725436

    • SHA256

      4e30f39ae6e696ed5ef6dd57a5144bcfde73bea5604179db13da438a33880bd2

    • SHA512

      58230fd980e814c77d6c0553c23a9fc3ce02e21dca049d7b56267b6df4acb705cddba5bab1bab60a3b94effc71ca0aaf3982446b2c90cc747f4008f7b5468485

    • SSDEEP

      1536:JxqjQ+P04wsmJCpEEt4AwMEz9UQz0QNeRBl5PT/rx1mzwRMSTdLpJPs:sr85Cn45MEyQ5QRrmzwR5Jk

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks