Overview

overview

10

Static

static

10

2025-01-13...ta.exe

windows7-x64

10

2025-01-13...ta.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-13_b10215d8341cb42b150b9fa5c5d35e3a_espilon-red_hijackloader_luca-stealer_neshta

  • Size

    3.1MB

  • Sample

    250113-ntynwatjar

  • MD5

    b10215d8341cb42b150b9fa5c5d35e3a

  • SHA1

    ecdc00f6cfd2e5d35cfb9b265d6b1898f8d9adf6

  • SHA256

    b0db251f62c0ef841992fb537ba60a0b6da64835ea86c6daaaad63ea830feb8d

  • SHA512

    ad834dfd134d16ef8762c070ff0c6e34d01a6aaa6b0dc825cfcabe85026e95675517fcdddc5e8a8d1fa5dd99577dfe50baef7e4849d1bbbbe71613450e1d1771

  • SSDEEP

    49152:qQT+RQyHelnwxzebw1aMDgn37ypG8psR+d/AQyua+7U1:7+RQoJxzebw1G3qf

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      2025-01-13_b10215d8341cb42b150b9fa5c5d35e3a_espilon-red_hijackloader_luca-stealer_neshta

    • Size

      3.1MB

    • MD5

      b10215d8341cb42b150b9fa5c5d35e3a

    • SHA1

      ecdc00f6cfd2e5d35cfb9b265d6b1898f8d9adf6

    • SHA256

      b0db251f62c0ef841992fb537ba60a0b6da64835ea86c6daaaad63ea830feb8d

    • SHA512

      ad834dfd134d16ef8762c070ff0c6e34d01a6aaa6b0dc825cfcabe85026e95675517fcdddc5e8a8d1fa5dd99577dfe50baef7e4849d1bbbbe71613450e1d1771

    • SSDEEP

      49152:qQT+RQyHelnwxzebw1aMDgn37ypG8psR+d/AQyua+7U1:7+RQoJxzebw1G3qf

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks