Overview

overview

10

Static

static

10

8fdea2ea99...99.exe

windows7-x64

10

8fdea2ea99...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8fdea2ea99895d9313ab9bed0f832e28085902c4ad6c3fa36f1d92e83a73bc99.7z

  • Size

    439KB

  • Sample

    241115-c2hf3swqfz

  • MD5

    6ac66eed7c4877933e92e38af2e50e53

  • SHA1

    423281a726e0f95e979fb71574530917783d55e8

  • SHA256

    bc177ce2506294bcc74047473c1a4a041b5de82e6c8ac2fe3ca402968aec73fe

  • SHA512

    6f86d8e90da29101b194e7cf8a8fae32e28d54129226c4eed22b77db39633c69fd6bb854a8d8d1f8a7004d060dc0f7eda31291261f255b8665cd39089eb4e56d

  • SSDEEP

    12288:DipJ5TwIkmdGScTFP+7zsNtC1zP84psfE6TUGPgdD:W7hwPCGd68CG3fEDG4dD

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      8fdea2ea99895d9313ab9bed0f832e28085902c4ad6c3fa36f1d92e83a73bc99

    • Size

      1.3MB

    • MD5

      c752e30c447fe60ecacef65c5864bc8c

    • SHA1

      ade59cb46ebd3c4c7205c273417cdc77acae985b

    • SHA256

      8fdea2ea99895d9313ab9bed0f832e28085902c4ad6c3fa36f1d92e83a73bc99

    • SHA512

      c2b154428da73a5ac8169d14f2593fbea0c2ac54e76eff9beb96ed56b69df3fe7e86f97d708ae4591f408341f1bb108acae122dd38f07a4db4f83972ce880baf

    • SSDEEP

      12288:rRmRgwCfpczREXzaQg6cwNzquFXRM7Zzyyql2d2VJuZHRtEN0McpE76vDNFSMGF+:Vp2zSXzaQgc5dXR+Zm4EkHRzPSMGF7Vg

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks