Overview

overview

10

Static

static

10

7071ff74ab...cN.exe

windows7-x64

10

7071ff74ab...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7071ff74ab70b9381c4aadb9d0d632a58c4752a7ecbe45626aa1ce596c236b1cN.exe

  • Size

    2.2MB

  • Sample

    241225-t5x5daymav

  • MD5

    649fcdcd42cf4540d19f8797315af740

  • SHA1

    c10e209c2b1fc9858c3bb50fd17eeaa386412f63

  • SHA256

    7071ff74ab70b9381c4aadb9d0d632a58c4752a7ecbe45626aa1ce596c236b1c

  • SHA512

    ed01b0e778fc324a72ab50cd2ca43450ff6cd6c241592aa40646ec615a809ac7a2e62db8a688f960578826d91761ee6bafa79104916ddfd514ad995183b7bc82

  • SSDEEP

    49152:DoEViY9lN1Q0iLZpD+T1uw15dGNBi1EQRV2GUFvRz8mGbSCEe64bM:DoU7jiLZx+RucbSAjRV2GUFvRzYbSCd0

Score
10/10
neshtadiscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      7071ff74ab70b9381c4aadb9d0d632a58c4752a7ecbe45626aa1ce596c236b1cN.exe

    • Size

      2.2MB

    • MD5

      649fcdcd42cf4540d19f8797315af740

    • SHA1

      c10e209c2b1fc9858c3bb50fd17eeaa386412f63

    • SHA256

      7071ff74ab70b9381c4aadb9d0d632a58c4752a7ecbe45626aa1ce596c236b1c

    • SHA512

      ed01b0e778fc324a72ab50cd2ca43450ff6cd6c241592aa40646ec615a809ac7a2e62db8a688f960578826d91761ee6bafa79104916ddfd514ad995183b7bc82

    • SSDEEP

      49152:DoEViY9lN1Q0iLZpD+T1uw15dGNBi1EQRV2GUFvRz8mGbSCEe64bM:DoU7jiLZx+RucbSAjRV2GUFvRzYbSCd0

    Score
    10/10
    neshtadiscoverypersistencespywarestealerupx

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks