Overview

overview

10

Static

static

10

2024-12-25...ta.exe

windows7-x64

10

2024-12-25...ta.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-25_363514d5d3b4266020a6c9a25be53b78_lockergoga_luca-stealer_neshta

  • Size

    1.4MB

  • Sample

    241225-3cj7gs1lgy

  • MD5

    363514d5d3b4266020a6c9a25be53b78

  • SHA1

    149b31cd0f62915be4ee9075d46d07293106c935

  • SHA256

    35bcf8a6b513d25014079a7294bd831b728c651cfe1878dcd4bcdc753d7749a0

  • SHA512

    ee2f5cb690c368af4d9775111de85a4e16ddb730e6b1f4502b4678394214f105f8516c509ae9c00436e06a6683ab3f8b967033b90da3f4407af3b0d530ad8fff

  • SSDEEP

    24576:GsVoJa7u+g2u2S7UmjcWdsooekbLSLr8kEsiZEEskkW8w0pMwbO9Hf4aFh6Z71GN:Gsisxd0EsiZE9k26wvaFh6918OOnX

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      2024-12-25_363514d5d3b4266020a6c9a25be53b78_lockergoga_luca-stealer_neshta

    • Size

      1.4MB

    • MD5

      363514d5d3b4266020a6c9a25be53b78

    • SHA1

      149b31cd0f62915be4ee9075d46d07293106c935

    • SHA256

      35bcf8a6b513d25014079a7294bd831b728c651cfe1878dcd4bcdc753d7749a0

    • SHA512

      ee2f5cb690c368af4d9775111de85a4e16ddb730e6b1f4502b4678394214f105f8516c509ae9c00436e06a6683ab3f8b967033b90da3f4407af3b0d530ad8fff

    • SSDEEP

      24576:GsVoJa7u+g2u2S7UmjcWdsooekbLSLr8kEsiZEEskkW8w0pMwbO9Hf4aFh6Z71GN:Gsisxd0EsiZE9k26wvaFh6918OOnX

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks