Overview

overview

10

Static

static

10

548b74b2b6...4N.exe

windows7-x64

10

548b74b2b6...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    548b74b2b620b39c0dac5f4380befd30a6a7aa88fd6948402e1a24cb67e70a34N.exe

  • Size

    4.7MB

  • Sample

    241201-qewbbawqcj

  • MD5

    2187c8c4594b55f0ebe056479e568b10

  • SHA1

    cee5de84eee46e25287650ab53b308e49209142e

  • SHA256

    548b74b2b620b39c0dac5f4380befd30a6a7aa88fd6948402e1a24cb67e70a34

  • SHA512

    8c7ff749c5cb690c5ae81e47b6a55f1cc2e1c99782c0cde2e11ab6228e093c09f0ac5614251869ae28defdb3f5ed74c68674fdc8179c01a81a1193fa571bc1cb

  • SSDEEP

    98304:FZz18GkRTJtA9MNhZkLkvNKY6nu1bZlN/9h5DTuYoj9ghi1RebMIg9Cbk/V8jqE:FZgtlNALeNX/9h5DTuYojDIg9Cbk/V83

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      548b74b2b620b39c0dac5f4380befd30a6a7aa88fd6948402e1a24cb67e70a34N.exe

    • Size

      4.7MB

    • MD5

      2187c8c4594b55f0ebe056479e568b10

    • SHA1

      cee5de84eee46e25287650ab53b308e49209142e

    • SHA256

      548b74b2b620b39c0dac5f4380befd30a6a7aa88fd6948402e1a24cb67e70a34

    • SHA512

      8c7ff749c5cb690c5ae81e47b6a55f1cc2e1c99782c0cde2e11ab6228e093c09f0ac5614251869ae28defdb3f5ed74c68674fdc8179c01a81a1193fa571bc1cb

    • SSDEEP

      98304:FZz18GkRTJtA9MNhZkLkvNKY6nu1bZlN/9h5DTuYoj9ghi1RebMIg9Cbk/V8jqE:FZgtlNALeNX/9h5DTuYojDIg9Cbk/V83

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks