Overview

overview

10

Static

static

10

Keygen.exe

windows7-x64

10

Keygen.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NLORG-MasterRDP.zip

  • Size

    2.5MB

  • Sample

    250213-ryznhszlc1

  • MD5

    de318bc7ff8e0bc87f8ad897b3102a7c

  • SHA1

    3b618e2a2abfe1f8a602309424810663dbc17888

  • SHA256

    78be8a69c18805b387012173facdcb79ad0efdcc3b45faba21b41011a5a3e3d2

  • SHA512

    81d82be1320e961e62ea125b0def02510898cc4d259785a3f4560bd102e86370d96170c162194efac204bcd8b62844ecbf510e0d35a17f13de515bdd5dd740b5

  • SSDEEP

    49152:8/Jev9V1ZFPsXkERNkamWmLxm6HwurcU4pEyfagxbybJeQdthmLcpoYK8e7GB77g:oiZFePNkjW0xdwC3K7Co2JltRGF8dVV2

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      Keygen.exe

    • Size

      2.5MB

    • MD5

      e72838eccda2eae29e96b0c572d783c3

    • SHA1

      60f0944ecbd21cf590445c12ba89a2ae48f27a6a

    • SHA256

      f824fdc666630ccb179d9086b79783e3ede76e4392a5edfdd20d93b7259ae061

    • SHA512

      7439902a4f16d29dcc4c749adc40f4541d509e607d915287c6c98f609ef14c4eb99ec507d7e7c853527a6c08628a367b21ae0f066828c2cc8792f2c1a3fa77f8

    • SSDEEP

      49152:IJdf39XFINkWr5kkYe6TdOYz44rcaMJIsjOO/ry3X0EdNZgJAxGEG8CZaFDG5UN:q9XaH5kheKdX4cjuR6q6XTNTI58ZTN

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks