General

  • Target

    affb6e3d3b4e72e570543d591c0a1562979413982565dbb9a77f8a07b76cca30N.exe

  • Size

    834KB

  • Sample

    241216-bgdrqawlcs

  • MD5

    7b0f8ac2a359512a45e33675c2125660

  • SHA1

    ddc2c5b65ebee4925fbbcf9055489a266d57b85d

  • SHA256

    affb6e3d3b4e72e570543d591c0a1562979413982565dbb9a77f8a07b76cca30

  • SHA512

    344c46671054527ce4c722f3a5c8bfb014d704dc1afa35bbddb11cbae1c25cf2d675251e51cb0aa3693204847effa088945749ee389444872ee9ba81ce4b1eba

  • SSDEEP

    12288:tDj3fIMDGfUUmb0kBKMadNA0Gdi8/ICCoUzTyGPc3M/5ri:Zj3fPDGfUUm/oMadNARdB/I7lTyG0Ii

Malware Config

Targets

    • Target

      affb6e3d3b4e72e570543d591c0a1562979413982565dbb9a77f8a07b76cca30N.exe

    • Size

      834KB

    • MD5

      7b0f8ac2a359512a45e33675c2125660

    • SHA1

      ddc2c5b65ebee4925fbbcf9055489a266d57b85d

    • SHA256

      affb6e3d3b4e72e570543d591c0a1562979413982565dbb9a77f8a07b76cca30

    • SHA512

      344c46671054527ce4c722f3a5c8bfb014d704dc1afa35bbddb11cbae1c25cf2d675251e51cb0aa3693204847effa088945749ee389444872ee9ba81ce4b1eba

    • SSDEEP

      12288:tDj3fIMDGfUUmb0kBKMadNA0Gdi8/ICCoUzTyGPc3M/5ri:Zj3fPDGfUUm/oMadNARdB/I7lTyG0Ii

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks