Overview

overview

10

Static

static

3

220ff89fed...81.exe

windows7-x64

10

220ff89fed...81.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    220ff89fed50b8591ec378094ec6a08f09372674b70b0f774f2bc50ee76d7281

  • Size

    6.6MB

  • Sample

    241018-yb12dsvbqd

  • MD5

    82b15f6b51dd0546aab7ca21b6deda65

  • SHA1

    7ec4fece518779064e76c35e4175216ca0895836

  • SHA256

    220ff89fed50b8591ec378094ec6a08f09372674b70b0f774f2bc50ee76d7281

  • SHA512

    062b03e5d2a5bf57a6723003142e8bde11a8f7bcd6c062669d917ee35f5657fde06121ecdccfba31ce47ba55c32ba1f86a5bdc7a93756971e4e9c82ec68ddc3d

  • SSDEEP

    98304:ThD+qZ3YOE+WOSkwXsvE0+DwQkiXCURv5jrm:1D+qZ3YrDwBSjDrm

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      220ff89fed50b8591ec378094ec6a08f09372674b70b0f774f2bc50ee76d7281

    • Size

      6.6MB

    • MD5

      82b15f6b51dd0546aab7ca21b6deda65

    • SHA1

      7ec4fece518779064e76c35e4175216ca0895836

    • SHA256

      220ff89fed50b8591ec378094ec6a08f09372674b70b0f774f2bc50ee76d7281

    • SHA512

      062b03e5d2a5bf57a6723003142e8bde11a8f7bcd6c062669d917ee35f5657fde06121ecdccfba31ce47ba55c32ba1f86a5bdc7a93756971e4e9c82ec68ddc3d

    • SSDEEP

      98304:ThD+qZ3YOE+WOSkwXsvE0+DwQkiXCURv5jrm:1D+qZ3YrDwBSjDrm

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks