Overview

overview

10

Static

static

10

87c3506d2c...3N.exe

windows7-x64

10

87c3506d2c...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87c3506d2c20485f2b1ffff6b5103adf449954207a342c7ac9d5b0266b49c643N.exe

  • Size

    550KB

  • Sample

    250102-att4sssrft

  • MD5

    7f27befa2624e606586e3afc9fd88eb0

  • SHA1

    e9dcc998d762a5d713d5658bbf89bb88730a99de

  • SHA256

    87c3506d2c20485f2b1ffff6b5103adf449954207a342c7ac9d5b0266b49c643

  • SHA512

    9b96c9f2a489f8d74da2716dbfbc053aa89068912650f5d92276bfb3cafd533d906f78aaea1b3e1c8dcb4ca02798edf77950d3f9877a72e449f57740f1c172de

  • SSDEEP

    12288:dLq3lCfNK3NBPTsPfu9nOS6cE/wSJrJXKQN32EQN32c:dLQQE/afEOSKoSJrxK

Score
10/10
neshtadiscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      87c3506d2c20485f2b1ffff6b5103adf449954207a342c7ac9d5b0266b49c643N.exe

    • Size

      550KB

    • MD5

      7f27befa2624e606586e3afc9fd88eb0

    • SHA1

      e9dcc998d762a5d713d5658bbf89bb88730a99de

    • SHA256

      87c3506d2c20485f2b1ffff6b5103adf449954207a342c7ac9d5b0266b49c643

    • SHA512

      9b96c9f2a489f8d74da2716dbfbc053aa89068912650f5d92276bfb3cafd533d906f78aaea1b3e1c8dcb4ca02798edf77950d3f9877a72e449f57740f1c172de

    • SSDEEP

      12288:dLq3lCfNK3NBPTsPfu9nOS6cE/wSJrJXKQN32EQN32c:dLQQE/afEOSKoSJrxK

    Score
    10/10
    neshtadiscoverypersistencespywarestealerupx

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks