Overview

overview

10

Static

static

10

39dc917fb2...62.exe

windows7-x64

10

39dc917fb2...62.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39dc917fb2285835b0ed52d5aa833be0cc3e3c903e5c6bc0f3c8ccbd9f406362

  • Size

    265KB

  • Sample

    250207-1wm2da1mbl

  • MD5

    4f49ef21a469a52352953ce99e0cf4b6

  • SHA1

    e1bf62cd4f3845ca47bf95e12e1bef0733d53785

  • SHA256

    39dc917fb2285835b0ed52d5aa833be0cc3e3c903e5c6bc0f3c8ccbd9f406362

  • SHA512

    139c76f25826eb408077ae001bf5c3305531846ee43fce4800c072f8174d47b345a673e3f11834a69c186634357f020c6372826dd1340ed5721b3e38d3ae4442

  • SSDEEP

    6144:k9t5IonvkFplmiWZ7KzHzXY4jqiKofzA3rSH/cuJS6B+jLNzNRsrWhrJkK/EqAik:vonvkFplmiWZ7AjY4jqiKofzA3rSH/ca

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      39dc917fb2285835b0ed52d5aa833be0cc3e3c903e5c6bc0f3c8ccbd9f406362

    • Size

      265KB

    • MD5

      4f49ef21a469a52352953ce99e0cf4b6

    • SHA1

      e1bf62cd4f3845ca47bf95e12e1bef0733d53785

    • SHA256

      39dc917fb2285835b0ed52d5aa833be0cc3e3c903e5c6bc0f3c8ccbd9f406362

    • SHA512

      139c76f25826eb408077ae001bf5c3305531846ee43fce4800c072f8174d47b345a673e3f11834a69c186634357f020c6372826dd1340ed5721b3e38d3ae4442

    • SSDEEP

      6144:k9t5IonvkFplmiWZ7KzHzXY4jqiKofzA3rSH/cuJS6B+jLNzNRsrWhrJkK/EqAik:vonvkFplmiWZ7AjY4jqiKofzA3rSH/ca

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks