General
- Target Curd.exe
- Size 7.5MB
- Sample241110-eby29asjhr
- SHA256 b406c1acec618c85ce1990fb931342aff9c5173b862b4a828b61cb89c24aa0c3
Score
10/10
Malware Config
Targets
-
- Target Curd.exe
- Size 7.5MB
- SHA256 b406c1acec618c85ce1990fb931342aff9c5173b862b4a828b61cb89c24aa0c3
Score10/10Detect Neshta payload
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
Neshta family
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Modifies system executable filetype association
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Enumerates processes with tasklist
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1