General

  • Target

    5b98a5667d8d715e759f98d87d6e7afe8101d126120b3a1cc38af3fbc0bc7f30N.exe

  • Size

    5.4MB

  • Sample

    241207-hcbvwszrft

  • MD5

    5903ff5989daeb737212efdfcc68e040

  • SHA1

    2327f797b986251c754ca046e8495ca853c7a2c3

  • SHA256

    5b98a5667d8d715e759f98d87d6e7afe8101d126120b3a1cc38af3fbc0bc7f30

  • SHA512

    7f1306c7acf51ec703600963ad017f990a01b81346e6a3559a22c532fba051ca57023bc787f1a727f213b43eef1ef58fed046e8566286ceca200aaf8d14ac33a

  • SSDEEP

    98304:B8P+ore3hUyhZTHJ/wh+9scxSntxDbMAOhe1+zgxa3xWf+RL5:2Pk3hUyhlGznzglZgxcNz

Malware Config

Targets

    • Target

      5b98a5667d8d715e759f98d87d6e7afe8101d126120b3a1cc38af3fbc0bc7f30N.exe

    • Size

      5.4MB

    • MD5

      5903ff5989daeb737212efdfcc68e040

    • SHA1

      2327f797b986251c754ca046e8495ca853c7a2c3

    • SHA256

      5b98a5667d8d715e759f98d87d6e7afe8101d126120b3a1cc38af3fbc0bc7f30

    • SHA512

      7f1306c7acf51ec703600963ad017f990a01b81346e6a3559a22c532fba051ca57023bc787f1a727f213b43eef1ef58fed046e8566286ceca200aaf8d14ac33a

    • SSDEEP

      98304:B8P+ore3hUyhZTHJ/wh+9scxSntxDbMAOhe1+zgxa3xWf+RL5:2Pk3hUyhlGznzglZgxcNz

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

MITRE ATT&CK Enterprise v15

Tasks