General

  • Target

    5aac027e68f28a67bf327deef39d1a592b5d33d0e1c0c9ffd1471a0a08c68494N.exe

  • Size

    133KB

  • Sample

    241217-crs5tsykfl

  • MD5

    789bb0c5743124599f4837ff4db70e50

  • SHA1

    bfea70be2805cb3db762a7799fd7dec94cd2cdb8

  • SHA256

    5aac027e68f28a67bf327deef39d1a592b5d33d0e1c0c9ffd1471a0a08c68494

  • SHA512

    ec6b02482ae7c7090cb85f27542539f35a264729a349b247b76aedb08907e6d8eb4ee21c23ece7779252eaf30dc46bca47a47fb51d6b39c4251711b5cacc0149

  • SSDEEP

    3072:zr8WDrC+c4mZx8Q8Cu1azdzOceGAOHejGk:PudZ9aaz9OcVY

Malware Config

Targets

    • Target

      5aac027e68f28a67bf327deef39d1a592b5d33d0e1c0c9ffd1471a0a08c68494N.exe

    • Size

      133KB

    • MD5

      789bb0c5743124599f4837ff4db70e50

    • SHA1

      bfea70be2805cb3db762a7799fd7dec94cd2cdb8

    • SHA256

      5aac027e68f28a67bf327deef39d1a592b5d33d0e1c0c9ffd1471a0a08c68494

    • SHA512

      ec6b02482ae7c7090cb85f27542539f35a264729a349b247b76aedb08907e6d8eb4ee21c23ece7779252eaf30dc46bca47a47fb51d6b39c4251711b5cacc0149

    • SSDEEP

      3072:zr8WDrC+c4mZx8Q8Cu1azdzOceGAOHejGk:PudZ9aaz9OcVY

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks