Overview

overview

10

Static

static

3

3405f44717...67.exe

windows7-x64

10

3405f44717...67.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3405f447175dd3f24e0692d79793e574e0389052262814111bb89cbcd3df4367

  • Size

    146KB

  • Sample

    240817-zg39daware

  • MD5

    a76a419e89c5f57c694ce9764021ab56

  • SHA1

    74f3b1f9a16eb89668bd4c255019a845f66b5143

  • SHA256

    3405f447175dd3f24e0692d79793e574e0389052262814111bb89cbcd3df4367

  • SHA512

    0d9a45102c4e221c4b0cc8e48972f1126f1184db6ed30baf18da7de6baa7cd57099e77cf740132aa17499179dfd9abbd3aaa9c8bdace610fed04ba66ea97f7b5

  • SSDEEP

    3072:zr8WDrCykbAYn2GgYlBYN2fHYTo+dit8wDSRUTT:PuTbAMpgY3gT08DRUTT

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      3405f447175dd3f24e0692d79793e574e0389052262814111bb89cbcd3df4367

    • Size

      146KB

    • MD5

      a76a419e89c5f57c694ce9764021ab56

    • SHA1

      74f3b1f9a16eb89668bd4c255019a845f66b5143

    • SHA256

      3405f447175dd3f24e0692d79793e574e0389052262814111bb89cbcd3df4367

    • SHA512

      0d9a45102c4e221c4b0cc8e48972f1126f1184db6ed30baf18da7de6baa7cd57099e77cf740132aa17499179dfd9abbd3aaa9c8bdace610fed04ba66ea97f7b5

    • SSDEEP

      3072:zr8WDrCykbAYn2GgYlBYN2fHYTo+dit8wDSRUTT:PuTbAMpgY3gT08DRUTT

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks