Overview

overview

10

Static

static

10

c757941d33...0N.exe

windows7-x64

10

c757941d33...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c757941d3352aca06000f6805a188e965ca885826247b2ca3ee34400eeef22c0N.exe

  • Size

    2.7MB

  • Sample

    241117-p5d92szgqd

  • MD5

    766ddbb417b22e484957c8f607b15f70

  • SHA1

    73dd6c033ef9b524c3d3041087493db12a332a99

  • SHA256

    c757941d3352aca06000f6805a188e965ca885826247b2ca3ee34400eeef22c0

  • SHA512

    972452578809161b58edcfd6f6dfe35a616d90c0c1b31e09b995a5bc1f1dec52c3c9a2f7218c326781e9286287fb4c9ae63ea206e9643ec5b7595a585011c340

  • SSDEEP

    49152:LpRz7GLyYf4jTHgjsBjzO+euu+euaa6aaa6666a666aaaa6aaa6666aUue+OOe+f:Lnz7G2YfCAejVuSvX0vwpzkt/kivUw5

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      c757941d3352aca06000f6805a188e965ca885826247b2ca3ee34400eeef22c0N.exe

    • Size

      2.7MB

    • MD5

      766ddbb417b22e484957c8f607b15f70

    • SHA1

      73dd6c033ef9b524c3d3041087493db12a332a99

    • SHA256

      c757941d3352aca06000f6805a188e965ca885826247b2ca3ee34400eeef22c0

    • SHA512

      972452578809161b58edcfd6f6dfe35a616d90c0c1b31e09b995a5bc1f1dec52c3c9a2f7218c326781e9286287fb4c9ae63ea206e9643ec5b7595a585011c340

    • SSDEEP

      49152:LpRz7GLyYf4jTHgjsBjzO+euu+euaa6aaa6666a666aaaa6aaa6666aUue+OOe+f:Lnz7G2YfCAejVuSvX0vwpzkt/kivUw5

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks