General

  • Target

    16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602

  • Size

    9.3MB

  • Sample

    241210-yqqh7swphz

  • MD5

    bf9bab6072fe8ebcaecc1963583c2889

  • SHA1

    8fefe9a419c1573ec3a32d1955f45afc5da1106b

  • SHA256

    16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602

  • SHA512

    2b57663d64e1f9b9fd9dd61c27ad79645bd476e4bdc000a8eda5bc5b81a9a684ae9c43cb0d7f7c13966b735759ac75b025b6d017bfb39c8c0c71b12bde25e057

  • SSDEEP

    196608:2qMS5A8r2wSwfhK2eilgTo3+jggWUCatEEZvZyMR7NZ:2g5x2hyK2e4g0TxatEEh8IJZ

Malware Config

Targets

    • Target

      16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602

    • Size

      9.3MB

    • MD5

      bf9bab6072fe8ebcaecc1963583c2889

    • SHA1

      8fefe9a419c1573ec3a32d1955f45afc5da1106b

    • SHA256

      16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602

    • SHA512

      2b57663d64e1f9b9fd9dd61c27ad79645bd476e4bdc000a8eda5bc5b81a9a684ae9c43cb0d7f7c13966b735759ac75b025b6d017bfb39c8c0c71b12bde25e057

    • SSDEEP

      196608:2qMS5A8r2wSwfhK2eilgTo3+jggWUCatEEZvZyMR7NZ:2g5x2hyK2e4g0TxatEEh8IJZ

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks