neshta | f2ab670f7f42080db0868764979c3ca0cacc895158b450715e3dfc22bcf33cc1 | Triage

Sharing

General

Target

f2ab670f7f42080db0868764979c3ca0cacc895158b450715e3dfc22bcf33cc1.exe
Size

237KB
Sample

250116-kvk8dstlen
MD5

43e96c800de427f840b19da4776c5df1
SHA1

c0024cd4c385b209ca587543f39c65ffd213c696
SHA256

f2ab670f7f42080db0868764979c3ca0cacc895158b450715e3dfc22bcf33cc1
SHA512

5457b391b6a7a91bfe87248eb39d2411616cbb687ae5524778faea9f458c326e072e5aee30ac813d86c35d22ccd1214b08b0269c5a8f46090fd4c8cd14a30d6a
SSDEEP

3072:zr8WDrCMLUebnZ1AFO9KaL4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv5fvpVQHGbTc2:PuM/bZ1AoLgVqwlL8pVRTc2

Score

10^/10

neshta xworm discovery persistence rat spyware stealer trojan

Malware Config

Targets

- Target
  
  f2ab670f7f42080db0868764979c3ca0cacc895158b450715e3dfc22bcf33cc1.exe
- Size
  
  237KB
- MD5
  
  43e96c800de427f840b19da4776c5df1
- SHA1
  
  c0024cd4c385b209ca587543f39c65ffd213c696
- SHA256
  
  f2ab670f7f42080db0868764979c3ca0cacc895158b450715e3dfc22bcf33cc1
- SHA512
  
  5457b391b6a7a91bfe87248eb39d2411616cbb687ae5524778faea9f458c326e072e5aee30ac813d86c35d22ccd1214b08b0269c5a8f46090fd4c8cd14a30d6a
- SSDEEP
  
  3072:zr8WDrCMLUebnZ1AFO9KaL4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv5fvpVQHGbTc2:PuM/bZ1AoLgVqwlL8pVRTc2
Score

10^/10

neshta discovery persistence spyware stealer xworm rat trojan
- Detect Xworm Payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespywarestealer

behavioral2

neshtaxwormdiscoverypersistenceratspywarestealertrojan