Overview

overview

10

Static

static

10

2847ae3e68...7N.exe

windows7-x64

10

2847ae3e68...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2847ae3e68984b01cd3addb1935e1dbe154dd8b5bc43933c0206b6d27e743237N

  • Size

    2.6MB

  • Sample

    241027-sthpwawret

  • MD5

    c45e779ff04c08182ca6266541544c10

  • SHA1

    c95d68133ad3a553d2786d999b3ab8ae0b9c9850

  • SHA256

    2847ae3e68984b01cd3addb1935e1dbe154dd8b5bc43933c0206b6d27e743237

  • SHA512

    729c92c528dc9f63bca5e59731a91fa468505b7dfed94330f37bd7c7dd929f5bf7aecce1eed2573441a853f51c9f46c592bc82c647f23957dd9b143b70d55aad

  • SSDEEP

    49152:8GGMGGSGG+4wHH6rGbGAVME/g1Mps9tmLv8Cv5uoT4BtYNzCxmihofZVkLc5gmGI:8GGMGGSGG+GrGbGiM+DpppIoIYIxTok4

Score
10/10
neshtadiscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      2847ae3e68984b01cd3addb1935e1dbe154dd8b5bc43933c0206b6d27e743237N

    • Size

      2.6MB

    • MD5

      c45e779ff04c08182ca6266541544c10

    • SHA1

      c95d68133ad3a553d2786d999b3ab8ae0b9c9850

    • SHA256

      2847ae3e68984b01cd3addb1935e1dbe154dd8b5bc43933c0206b6d27e743237

    • SHA512

      729c92c528dc9f63bca5e59731a91fa468505b7dfed94330f37bd7c7dd929f5bf7aecce1eed2573441a853f51c9f46c592bc82c647f23957dd9b143b70d55aad

    • SSDEEP

      49152:8GGMGGSGG+4wHH6rGbGAVME/g1Mps9tmLv8Cv5uoT4BtYNzCxmihofZVkLc5gmGI:8GGMGGSGG+GrGbGiM+DpppIoIYIxTok4

    Score
    10/10
    neshtadiscoverypersistencespywarestealerupx

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks