Overview

overview

10

Static

static

10

1d226b5629...2N.exe

windows7-x64

10

1d226b5629...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d226b56295ad4b0ab6b908b8e9b2275960de0d607c4f53394519d4187e4ec42N.exe

  • Size

    9.0MB

  • Sample

    241205-cantsaslet

  • MD5

    ee338d60fbd0d7c40241a8162021fc70

  • SHA1

    1b47304d70c59457317e7ad80a4b7908cb7b6501

  • SHA256

    1d226b56295ad4b0ab6b908b8e9b2275960de0d607c4f53394519d4187e4ec42

  • SHA512

    37079c6d6d3abce0e03f25d5a91cd9b108943b24d2b6b17559e976aaba73de8eaee8f43013571fa167a7ff6ae75f13e6d38f0c99da87220c786eaac4e0ec8128

  • SSDEEP

    98304:rcWWRIkaeXtJngYtpGRF03Adojw3EW9EU12ihD0g0lPiZSEwXDfUJVIYZuT18xO+:wlNb3T8EU6hzEZVDKWqK

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      1d226b56295ad4b0ab6b908b8e9b2275960de0d607c4f53394519d4187e4ec42N.exe

    • Size

      9.0MB

    • MD5

      ee338d60fbd0d7c40241a8162021fc70

    • SHA1

      1b47304d70c59457317e7ad80a4b7908cb7b6501

    • SHA256

      1d226b56295ad4b0ab6b908b8e9b2275960de0d607c4f53394519d4187e4ec42

    • SHA512

      37079c6d6d3abce0e03f25d5a91cd9b108943b24d2b6b17559e976aaba73de8eaee8f43013571fa167a7ff6ae75f13e6d38f0c99da87220c786eaac4e0ec8128

    • SSDEEP

      98304:rcWWRIkaeXtJngYtpGRF03Adojw3EW9EU12ihD0g0lPiZSEwXDfUJVIYZuT18xO+:wlNb3T8EU6hzEZVDKWqK

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks