Overview

overview

10

Static

static

10

a55db9a669...59.exe

windows7-x64

10

a55db9a669...59.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5544bcf7cdc16_startmenuexperience_20507839900.zip

  • Size

    904KB

  • Sample

    241226-yzmhxayjfl

  • MD5

    0c369d9b9881136eaae5ceaad6124c7f

  • SHA1

    cf2fb9e5fa107b1a3f9f9d4d0a6b790ad1f92e70

  • SHA256

    7588cb72a564bdcb7eae9dc5a918a93d7e174f4133003446e17d5b8b275840fa

  • SHA512

    d2c57366322b9bfe0275bcbcf7ae280ba5802cd65efc320526679d3b4852be7e1848b0bcc16ea322d9a9f69745384d0ab217da1155aab1720a2469f016c8b6d3

  • SSDEEP

    24576:V+qPfHhYCyqHw9Jyj3gkpvVhcglyZ0C6l:V+QfGCyqHjpty5Ho

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      a55db9a669a259fc2da60a11ed3920fbcb537a8a438dcf6ff05c581778c81c59

    • Size

      2.1MB

    • MD5

      28f60ef778f3f6ab6b2bd17eb4d44195

    • SHA1

      5544bcf7cdc169e4be2dfbcf92159fb79da2a6e4

    • SHA256

      a55db9a669a259fc2da60a11ed3920fbcb537a8a438dcf6ff05c581778c81c59

    • SHA512

      ebb76f1906be09899cb4b8619264dd0c57ae068aa023e5ab1a739518a5100a3e6bb7fe0c5ba9d1aaff5af3b308a5eb51f7b0f914efeac012eaa3504293a97ba0

    • SSDEEP

      49152:xlwXIuBR3PErb/THvO90d7HjmAFd4A64nsfJ8Zu3IFz/+CWXcSgXOOXoqaP5cLDR:Ux3PGuYFzI0

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks