Overview

overview

10

Static

static

10

15d231da8c...7N.exe

windows7-x64

10

15d231da8c...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15d231da8cb27ddd5440fa31064f94ecf8c9c8f92a649d8a3d887edd30d26d37N.exe

  • Size

    1.1MB

  • Sample

    241218-e8vfbstkbs

  • MD5

    69c291bcdcbbaaf3b8f8b9b14fe252b0

  • SHA1

    751d2191cb71420b189389058ae836146a5419c7

  • SHA256

    15d231da8cb27ddd5440fa31064f94ecf8c9c8f92a649d8a3d887edd30d26d37

  • SHA512

    ce6182de0d25fa6041f905d7c5d023f7eea68c09e7ab15e6de42337de03125b11989b7aa74c5f5609d07424c2ba654bf03e6fdff042d14cfbe8c0bb7d535fde5

  • SSDEEP

    6144:k9jIpZdnWiSx+U7dSiG9LkviQj4pc9b4NnohPpTi/DkrydJ+Qsw+Iu77DzizbUNE:PWi5ko4i/6yJn6DzyKV6

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      15d231da8cb27ddd5440fa31064f94ecf8c9c8f92a649d8a3d887edd30d26d37N.exe

    • Size

      1.1MB

    • MD5

      69c291bcdcbbaaf3b8f8b9b14fe252b0

    • SHA1

      751d2191cb71420b189389058ae836146a5419c7

    • SHA256

      15d231da8cb27ddd5440fa31064f94ecf8c9c8f92a649d8a3d887edd30d26d37

    • SHA512

      ce6182de0d25fa6041f905d7c5d023f7eea68c09e7ab15e6de42337de03125b11989b7aa74c5f5609d07424c2ba654bf03e6fdff042d14cfbe8c0bb7d535fde5

    • SSDEEP

      6144:k9jIpZdnWiSx+U7dSiG9LkviQj4pc9b4NnohPpTi/DkrydJ+Qsw+Iu77DzizbUNE:PWi5ko4i/6yJn6DzyKV6

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks