Overview

overview

10

Static

static

10

0efc4c3b05...4N.exe

windows7-x64

10

0efc4c3b05...4N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0efc4c3b05fcbc4d266c6dd8ca9c9ff3bbfe37b83106f3a3eb06f1e909bfa374N

  • Size

    168KB

  • Sample

    240928-pzk6eaygqd

  • MD5

    ecfec99337df1cfda1ea34441f007ea0

  • SHA1

    0cd179f3208f8482d8375112d6708bc79f87b8fb

  • SHA256

    0efc4c3b05fcbc4d266c6dd8ca9c9ff3bbfe37b83106f3a3eb06f1e909bfa374

  • SHA512

    0de733065b9958c06e260749ca3f76fb4a606b47606f0316c6b32d083600154f72f2ee9c403e112092a340d174c7dca3a4ecf9c6a0a4d8c3ec98d1ee15194432

  • SSDEEP

    3072:sr85Cd1C+l08jlwJrnS+zsaACam3xpKRRW5oB:k9SWnWJjS/CammRYo

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      0efc4c3b05fcbc4d266c6dd8ca9c9ff3bbfe37b83106f3a3eb06f1e909bfa374N

    • Size

      168KB

    • MD5

      ecfec99337df1cfda1ea34441f007ea0

    • SHA1

      0cd179f3208f8482d8375112d6708bc79f87b8fb

    • SHA256

      0efc4c3b05fcbc4d266c6dd8ca9c9ff3bbfe37b83106f3a3eb06f1e909bfa374

    • SHA512

      0de733065b9958c06e260749ca3f76fb4a606b47606f0316c6b32d083600154f72f2ee9c403e112092a340d174c7dca3a4ecf9c6a0a4d8c3ec98d1ee15194432

    • SSDEEP

      3072:sr85Cd1C+l08jlwJrnS+zsaACam3xpKRRW5oB:k9SWnWJjS/CammRYo

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks