General

  • Target

    09e1bda51bb9c5f32f3f514e0d28d21e1c35d25a40c03e28b3c2c746794551bbN

  • Size

    317KB

  • Sample

    241030-lnazhsyre1

  • MD5

    f593cadace77a4118dbaf033f1032850

  • SHA1

    e91ff6e997cec62e2ef378da6edf5378b869cdfe

  • SHA256

    09e1bda51bb9c5f32f3f514e0d28d21e1c35d25a40c03e28b3c2c746794551bb

  • SHA512

    5bca077860308afcf61b392f614135b5c74ee4d5bb43fe90b17037a3ab479233ba6058685f0069bf261c628e9bc4db1ad0fbe2b4e84694c9793bec095a1d9011

  • SSDEEP

    6144:k9/U53ADYbj4prMq+2FFd3TEghXRux0yKuhpnar8oUeZR0YOEJZdKYJ:2QQDJpg2p3ThHy/L1onZRbZb4YJ

Malware Config

Targets

    • Target

      09e1bda51bb9c5f32f3f514e0d28d21e1c35d25a40c03e28b3c2c746794551bbN

    • Size

      317KB

    • MD5

      f593cadace77a4118dbaf033f1032850

    • SHA1

      e91ff6e997cec62e2ef378da6edf5378b869cdfe

    • SHA256

      09e1bda51bb9c5f32f3f514e0d28d21e1c35d25a40c03e28b3c2c746794551bb

    • SHA512

      5bca077860308afcf61b392f614135b5c74ee4d5bb43fe90b17037a3ab479233ba6058685f0069bf261c628e9bc4db1ad0fbe2b4e84694c9793bec095a1d9011

    • SSDEEP

      6144:k9/U53ADYbj4prMq+2FFd3TEghXRux0yKuhpnar8oUeZR0YOEJZdKYJ:2QQDJpg2p3ThHy/L1onZRbZb4YJ

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks