Overview

overview

10

Static

static

10

6d13164d53...c5.exe

windows7-x64

10

6d13164d53...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d13164d53d8fd58b5eefa57a6e6dd6da2335c986ce7b8562184ca4d2a2043c5

  • Size

    2.1MB

  • Sample

    241031-ayb4sawpdp

  • MD5

    1bbd6849abd2549ab2979f9c257c1562

  • SHA1

    86df4c9647157c24c7529702224597f1c4540fbb

  • SHA256

    6d13164d53d8fd58b5eefa57a6e6dd6da2335c986ce7b8562184ca4d2a2043c5

  • SHA512

    cf750badebedf75456a3680f6dedea07b80842e6efa12620574bf34aa6171a7c1f82aa444515a905e6f8ded975616de1137de4a27ef168633a4266355e2465d4

  • SSDEEP

    49152:649dU9nTEhaR59l1OzQXsRNyOr7YuDwebnsI63/0Vbn1dF2npqO1uJr:B9dU9n+K5jozQXCyOrYebAv0VZ2nT1uB

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      6d13164d53d8fd58b5eefa57a6e6dd6da2335c986ce7b8562184ca4d2a2043c5

    • Size

      2.1MB

    • MD5

      1bbd6849abd2549ab2979f9c257c1562

    • SHA1

      86df4c9647157c24c7529702224597f1c4540fbb

    • SHA256

      6d13164d53d8fd58b5eefa57a6e6dd6da2335c986ce7b8562184ca4d2a2043c5

    • SHA512

      cf750badebedf75456a3680f6dedea07b80842e6efa12620574bf34aa6171a7c1f82aa444515a905e6f8ded975616de1137de4a27ef168633a4266355e2465d4

    • SSDEEP

      49152:649dU9nTEhaR59l1OzQXsRNyOr7YuDwebnsI63/0Vbn1dF2npqO1uJr:B9dU9n+K5jozQXCyOrYebAv0VZ2nT1uB

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks