Overview

overview

10

Static

static

3

INVOICE.exe

windows7-x64

10

INVOICE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cdfb9986ffd44252d4f73d0ce10bfd2f94549fbf6433cc3d65dbb28bc70398c

  • Size

    719KB

  • Sample

    250123-fb9z7atqbr

  • MD5

    c6e711e4f663aab97f2f862aef3ab93f

  • SHA1

    b5f9f7e3b82963cfd999331d6a389a057a3f305d

  • SHA256

    1cdfb9986ffd44252d4f73d0ce10bfd2f94549fbf6433cc3d65dbb28bc70398c

  • SHA512

    bac12d113b6e6ade50fde4651ffd69618619fdc24a82d2cbc3f2f45269c1c361ac9c59fc3f32ae1959da66e8911238a50afe1de9823697951f23304317056e50

  • SSDEEP

    12288:/+TvUf4E3M6zvG07/UO5lBa1dpWxm0fvALtw0+OCM+7SpVM2Wa:/+Te4UtWWWSgJFfKri

Score
10/10
neshtadiscoveryexecutionpersistencespywarestealer

Malware Config

Targets

    • Target

      INVOICE.exe

    • Size

      869KB

    • MD5

      97efcdff66ed144ceaa7f5417c595344

    • SHA1

      9ba3a0dbc29763783aa177b49538c441f128ee5a

    • SHA256

      834d7c633fa71e5139742a09c966e11e0fd5a4080f25568bb0f932aa60e4f0d7

    • SHA512

      3baa03334a606e60bacb4f7478252ac3a1fa77ab1f429d72d9db0f37b791eda7bbfe4359a373fa43a2a2e9de1a744fa17fc1cd105fcc4dd1480272aac97dd04c

    • SSDEEP

      12288:AydsFtkjM6VbGA7/Um5TBa1RHcZFto8xO0jvAxz4s+MIMc7S7VA+knfWrc:8cXCuCHj8xrUlDJc7+Emc

    Score
    10/10
    neshtadiscoveryexecutionpersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks