General

  • Target

    56e47df5c86127609292b547ed438d70N.exe

  • Size

    81KB

  • Sample

    240725-crk48asepp

  • MD5

    56e47df5c86127609292b547ed438d70

  • SHA1

    097600bda31a466f0e8b007d66dc526bd2244f41

  • SHA256

    0d99bcbef37b6b8c0cadd2a58fca367773d0e2696c6779aefe54c01af8dd234d

  • SHA512

    59ef0df1ef3f9f67463c27246a7bdf9e7ce6b03a1264e4f14a78e54cff1e76fb9849e66d23091cae76067eab3fe171890b8e10e809c0291fff13ee7089f80f0e

  • SSDEEP

    1536:JxqjQ+P04wsmJCKyHi0Lqv4hrUhPMJFvpzH:sr85Cpi0Le4hSMXp7

Malware Config

Targets

    • Target

      56e47df5c86127609292b547ed438d70N.exe

    • Size

      81KB

    • MD5

      56e47df5c86127609292b547ed438d70

    • SHA1

      097600bda31a466f0e8b007d66dc526bd2244f41

    • SHA256

      0d99bcbef37b6b8c0cadd2a58fca367773d0e2696c6779aefe54c01af8dd234d

    • SHA512

      59ef0df1ef3f9f67463c27246a7bdf9e7ce6b03a1264e4f14a78e54cff1e76fb9849e66d23091cae76067eab3fe171890b8e10e809c0291fff13ee7089f80f0e

    • SSDEEP

      1536:JxqjQ+P04wsmJCKyHi0Lqv4hrUhPMJFvpzH:sr85Cpi0Le4hSMXp7

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks