Overview

overview

10

Static

static

10

12b641db1f...14.exe

windows7-x64

10

12b641db1f...14.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12b641db1f86d66a59677027f9e97de19f26a9ca210b318f58090ae3754d7814

  • Size

    1.8MB

  • Sample

    241204-yjgbystmfk

  • MD5

    5373c6e4623a4850dcb01758830cae91

  • SHA1

    68dbd5d0bf96e6a8561c01918755c1a9e661938d

  • SHA256

    12b641db1f86d66a59677027f9e97de19f26a9ca210b318f58090ae3754d7814

  • SHA512

    6c09e92952a1431c1963562b273a88e391732d8fd79b32c8de788a8e17bf667d9083d5349d8af9038dcab0e63d92bffdb8cdbecd803b370aa67cec3dbad57b53

  • SSDEEP

    49152:mTksIf5NqPSApkZh3hqsXNAmoDZM5VyD4Z:mTkXhOSZhdMxD8

Score
10/10
neshtadiscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      12b641db1f86d66a59677027f9e97de19f26a9ca210b318f58090ae3754d7814

    • Size

      1.8MB

    • MD5

      5373c6e4623a4850dcb01758830cae91

    • SHA1

      68dbd5d0bf96e6a8561c01918755c1a9e661938d

    • SHA256

      12b641db1f86d66a59677027f9e97de19f26a9ca210b318f58090ae3754d7814

    • SHA512

      6c09e92952a1431c1963562b273a88e391732d8fd79b32c8de788a8e17bf667d9083d5349d8af9038dcab0e63d92bffdb8cdbecd803b370aa67cec3dbad57b53

    • SSDEEP

      49152:mTksIf5NqPSApkZh3hqsXNAmoDZM5VyD4Z:mTkXhOSZhdMxD8

    Score
    10/10
    neshtadiscoverypersistencespywarestealerupx

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks