Overview

overview

10

Static

static

10

9de0050189...0N.exe

windows7-x64

10

9de0050189...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9de00501891135fe9dc64f866f844940N.exe

  • Size

    425KB

  • Sample

    240726-h535vatdqq

  • MD5

    9de00501891135fe9dc64f866f844940

  • SHA1

    c28da85c108bf2bb86c98e54841b67b8c90119ae

  • SHA256

    fc14d9dfec6619a21959b788d610a89570caa43ee5a35647dcc13161ef2cf2be

  • SHA512

    90f6f56962a8a3d5885317e9378afbd7d5063acd17619b08c1fd32c26db2901fc56a3e11dc395c118ffcb0d91ecd7fdf072e73ada24948f1dc8093697bc7be1c

  • SSDEEP

    6144:k9UsSJEr8JoqVtUvNhlvPgGcMEF8ksmTPLiTvbv0ticwAwdg:iSS8JoqVtUvNz4ckswivpcwAwdg

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      9de00501891135fe9dc64f866f844940N.exe

    • Size

      425KB

    • MD5

      9de00501891135fe9dc64f866f844940

    • SHA1

      c28da85c108bf2bb86c98e54841b67b8c90119ae

    • SHA256

      fc14d9dfec6619a21959b788d610a89570caa43ee5a35647dcc13161ef2cf2be

    • SHA512

      90f6f56962a8a3d5885317e9378afbd7d5063acd17619b08c1fd32c26db2901fc56a3e11dc395c118ffcb0d91ecd7fdf072e73ada24948f1dc8093697bc7be1c

    • SSDEEP

      6144:k9UsSJEr8JoqVtUvNhlvPgGcMEF8ksmTPLiTvbv0ticwAwdg:iSS8JoqVtUvNz4ckswivpcwAwdg

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks