Overview

overview

10

Static

static

10

2025-01-07...ta.exe

windows7-x64

10

2025-01-07...ta.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-07_9cf51217cc4b4b9230916527651b5a15_hijackloader_lockergoga_luca-stealer_neshta

  • Size

    1.4MB

  • Sample

    250107-x3snnavmdw

  • MD5

    9cf51217cc4b4b9230916527651b5a15

  • SHA1

    c3d6067a14c245fa8156e10bd5ada98a145285c7

  • SHA256

    8d8627f2a3a8b227ff882b956adb0047beb4e0f72a5e75651ee323e5c7d12af1

  • SHA512

    19d71f552342e26a3bafa52b1fb3e3a5977f8a749e029f645d84f86b16184dc374fa7ed6698b0ac37f567cf7509016865625dcd99d81800011a9618cd6dfc094

  • SSDEEP

    24576:kH90QD2yybr0oDlM/nZtxSxSEgRDKm2R7XB7ZFITqpvZUl5/yrxLwd8n5TvZP6:kjibIf/Ztxe/lZFITqpBUl5/8dv5TZC

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      2025-01-07_9cf51217cc4b4b9230916527651b5a15_hijackloader_lockergoga_luca-stealer_neshta

    • Size

      1.4MB

    • MD5

      9cf51217cc4b4b9230916527651b5a15

    • SHA1

      c3d6067a14c245fa8156e10bd5ada98a145285c7

    • SHA256

      8d8627f2a3a8b227ff882b956adb0047beb4e0f72a5e75651ee323e5c7d12af1

    • SHA512

      19d71f552342e26a3bafa52b1fb3e3a5977f8a749e029f645d84f86b16184dc374fa7ed6698b0ac37f567cf7509016865625dcd99d81800011a9618cd6dfc094

    • SSDEEP

      24576:kH90QD2yybr0oDlM/nZtxSxSEgRDKm2R7XB7ZFITqpvZUl5/yrxLwd8n5TvZP6:kjibIf/Ztxe/lZFITqpBUl5/8dv5TZC

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks