General

  • Target

    648026816c2df29bfec23bb731d924427a4c90cf0f3c63f56ecd79720d8f2424N.exe

  • Size

    987KB

  • Sample

    241130-rhch2swkdw

  • MD5

    549ef590db21892e3b17991fb1cb7210

  • SHA1

    779bf7398b5aca6f1f2e449a22a454adb2171440

  • SHA256

    648026816c2df29bfec23bb731d924427a4c90cf0f3c63f56ecd79720d8f2424

  • SHA512

    9b0e147a234d8b238b387692db11693fb4a0748f2229869a2ca81ae81a17237ce95d17ddf2a8e47cc4b9981e6410f11b0bb4b8b1b6a0cfca2996ec059f76a0a3

  • SSDEEP

    24576:+RZkLjoXAINh3NTTSc/fcXcpui+fR2LZS:+RK2ZNTTZ3piRa0

Malware Config

Targets

    • Target

      648026816c2df29bfec23bb731d924427a4c90cf0f3c63f56ecd79720d8f2424N.exe

    • Size

      987KB

    • MD5

      549ef590db21892e3b17991fb1cb7210

    • SHA1

      779bf7398b5aca6f1f2e449a22a454adb2171440

    • SHA256

      648026816c2df29bfec23bb731d924427a4c90cf0f3c63f56ecd79720d8f2424

    • SHA512

      9b0e147a234d8b238b387692db11693fb4a0748f2229869a2ca81ae81a17237ce95d17ddf2a8e47cc4b9981e6410f11b0bb4b8b1b6a0cfca2996ec059f76a0a3

    • SSDEEP

      24576:+RZkLjoXAINh3NTTSc/fcXcpui+fR2LZS:+RK2ZNTTZ3piRa0

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks