Overview

overview

10

Static

static

10

c4ee733ac9...bc.exe

windows7-x64

10

c4ee733ac9...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c4ee733ac90ec7d722e7129ca0a01d9c1e2cbe55acba8eb307135f43b6ee54bc

  • Size

    353KB

  • Sample

    241030-e51g6svpgs

  • MD5

    6a4044fe64cd5192415bbb369807ab62

  • SHA1

    134b2c940584d621c8bf89c1f992d0fccd099d05

  • SHA256

    c4ee733ac90ec7d722e7129ca0a01d9c1e2cbe55acba8eb307135f43b6ee54bc

  • SHA512

    7ccb3a1fe55b5a06446788050f945d2ed444dfb047160d91442388e21b6826077289cc99fcc799c0498cf55269ff85687ac0334aaae60d01aac1bdc26e84bd9f

  • SSDEEP

    6144:k9/A7XMEF2w8DMdzYMQNjEHXux0yKuhXSUfdNDfGVKeVd5lJXR+TdqST6R:2A71FT8DgYTjay/tSUfmpNXRAkOs

Score
10/10
neshtadiscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      c4ee733ac90ec7d722e7129ca0a01d9c1e2cbe55acba8eb307135f43b6ee54bc

    • Size

      353KB

    • MD5

      6a4044fe64cd5192415bbb369807ab62

    • SHA1

      134b2c940584d621c8bf89c1f992d0fccd099d05

    • SHA256

      c4ee733ac90ec7d722e7129ca0a01d9c1e2cbe55acba8eb307135f43b6ee54bc

    • SHA512

      7ccb3a1fe55b5a06446788050f945d2ed444dfb047160d91442388e21b6826077289cc99fcc799c0498cf55269ff85687ac0334aaae60d01aac1bdc26e84bd9f

    • SSDEEP

      6144:k9/A7XMEF2w8DMdzYMQNjEHXux0yKuhXSUfdNDfGVKeVd5lJXR+TdqST6R:2A71FT8DgYTjay/tSUfmpNXRAkOs

    Score
    10/10
    neshtadiscoverypersistencespywarestealerupx

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks