Overview

overview

10

Static

static

10

cdd6a03d6f...2e.exe

windows7-x64

10

cdd6a03d6f...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cdd6a03d6fdeaa303d468b61a398ccaff15a2254645ca3be9aae2a18d976c12e.exe

  • Size

    396KB

  • Sample

    241126-qw7qnstkes

  • MD5

    8be769decf77e226bfc75131c3db0d7e

  • SHA1

    d56753acf758b49c49e87bc620327d65b2dec0f5

  • SHA256

    cdd6a03d6fdeaa303d468b61a398ccaff15a2254645ca3be9aae2a18d976c12e

  • SHA512

    c6365d907ca09f52eb5ef613213d02752ad95453314ac9047324e116a9a57778082651cb234173f15c2f7f5dae35de7484b8f92e895f41e25ee11037f3dd2848

  • SSDEEP

    3072:sr85CZ5UiDVQZYKrt33HtE9qmDoOAg0FubrAzqL30J5PTXw1RLpd5lPkLnoeGtKe:k9ZaXZLrtHteAO/Mqo/Lw1RPsLnU4VhI

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      cdd6a03d6fdeaa303d468b61a398ccaff15a2254645ca3be9aae2a18d976c12e.exe

    • Size

      396KB

    • MD5

      8be769decf77e226bfc75131c3db0d7e

    • SHA1

      d56753acf758b49c49e87bc620327d65b2dec0f5

    • SHA256

      cdd6a03d6fdeaa303d468b61a398ccaff15a2254645ca3be9aae2a18d976c12e

    • SHA512

      c6365d907ca09f52eb5ef613213d02752ad95453314ac9047324e116a9a57778082651cb234173f15c2f7f5dae35de7484b8f92e895f41e25ee11037f3dd2848

    • SSDEEP

      3072:sr85CZ5UiDVQZYKrt33HtE9qmDoOAg0FubrAzqL30J5PTXw1RLpd5lPkLnoeGtKe:k9ZaXZLrtHteAO/Mqo/Lw1RPsLnU4VhI

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks