Overview

overview

10

Static

static

10

7d5e1f4288...fe.exe

windows7-x64

10

7d5e1f4288...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d5e1f4288f6d623823225850256f5d01f40347d6cf326ebf80ee6ade39308fe

  • Size

    167KB

  • Sample

    241112-3ywseawqdn

  • MD5

    c5c88617be5b089f745657cb7aef8781

  • SHA1

    ec213937afe072a790d74916c3ee9b7592cefcd2

  • SHA256

    7d5e1f4288f6d623823225850256f5d01f40347d6cf326ebf80ee6ade39308fe

  • SHA512

    1d414cf9e9beff5b2e843ca578690cf921163808a65765d6ae1ef809bb1555519a530a7b4f1f5e177c50956dd1bafc87eba72449781c7203be6ffd202f54d354

  • SSDEEP

    3072:sr85Cisqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSPo/8/25jvDSs:k9izsb5Uh28+V1WW69B9VjMdxPedN9uJ

Score
10/10
neshtadiscoveryexecutionpersistencespywarestealer

Malware Config

Targets

    • Target

      7d5e1f4288f6d623823225850256f5d01f40347d6cf326ebf80ee6ade39308fe

    • Size

      167KB

    • MD5

      c5c88617be5b089f745657cb7aef8781

    • SHA1

      ec213937afe072a790d74916c3ee9b7592cefcd2

    • SHA256

      7d5e1f4288f6d623823225850256f5d01f40347d6cf326ebf80ee6ade39308fe

    • SHA512

      1d414cf9e9beff5b2e843ca578690cf921163808a65765d6ae1ef809bb1555519a530a7b4f1f5e177c50956dd1bafc87eba72449781c7203be6ffd202f54d354

    • SSDEEP

      3072:sr85Cisqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSPo/8/25jvDSs:k9izsb5Uh28+V1WW69B9VjMdxPedN9uJ

    Score
    10/10
    neshtadiscoveryexecutionpersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks