Overview

overview

10

Static

static

10

b98493ed0b...fN.exe

windows7-x64

10

b98493ed0b...fN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b98493ed0bf452a82c15e48cf17a915f009fb9e630edd167d5f7c8b8605f8a4fN

  • Size

    350KB

  • Sample

    241011-pkbcnasame

  • MD5

    981e8aebdde820b4a31f3f2bc46664e0

  • SHA1

    83570359d2d82cd138b2f5bebeb20c171eb6d047

  • SHA256

    b98493ed0bf452a82c15e48cf17a915f009fb9e630edd167d5f7c8b8605f8a4f

  • SHA512

    eecb25fba0e6b5c546560558cb84464f8e6990ab717f4aa0ad11cfeffa3150b043b143bb48d1aada87b4a410612cc23e9bca97a355679167c803944e6f604808

  • SSDEEP

    3072:sr85CJ0qmb9sfK34RN6JA37mXKjK6nSzFlzbI41MtTDO7oBgNklkMAkhkKiicIQc:k96dsfAIZpj5Y/I41Paqd8YSB

Score
10/10
neshtadefense_evasiondiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      b98493ed0bf452a82c15e48cf17a915f009fb9e630edd167d5f7c8b8605f8a4fN

    • Size

      350KB

    • MD5

      981e8aebdde820b4a31f3f2bc46664e0

    • SHA1

      83570359d2d82cd138b2f5bebeb20c171eb6d047

    • SHA256

      b98493ed0bf452a82c15e48cf17a915f009fb9e630edd167d5f7c8b8605f8a4f

    • SHA512

      eecb25fba0e6b5c546560558cb84464f8e6990ab717f4aa0ad11cfeffa3150b043b143bb48d1aada87b4a410612cc23e9bca97a355679167c803944e6f604808

    • SSDEEP

      3072:sr85CJ0qmb9sfK34RN6JA37mXKjK6nSzFlzbI41MtTDO7oBgNklkMAkhkKiicIQc:k96dsfAIZpj5Y/I41Paqd8YSB

    Score
    10/10
    neshtadefense_evasiondiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks