Overview

overview

10

Static

static

PO.exe

windows7_x64

10

PO.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO.exe

  • Size

    780KB

  • Sample

    211005-f52kxahedk

  • MD5

    986021bcec991cf8e2e30c14b59f68ad

  • SHA1

    ec06450569675fe896382de46a465b0118256ec2

  • SHA256

    ab9f07758d73614eb4b307ffe5f88e28c62ffdb94a011874dcc2e992fd0e2ca0

  • SHA512

    270db5e70fc36d9c5452728a9e0d1d5cb80e727720c04622bd84b00c5ffd7368c3c55737eb855e2b6cb7e112af42934a41c592f3586fe89bf5006ada8aa8aec3

Score
10/10
neshtapersistencespyware

Malware Config

Targets

    • Target

      PO.exe

    • Size

      780KB

    • MD5

      986021bcec991cf8e2e30c14b59f68ad

    • SHA1

      ec06450569675fe896382de46a465b0118256ec2

    • SHA256

      ab9f07758d73614eb4b307ffe5f88e28c62ffdb94a011874dcc2e992fd0e2ca0

    • SHA512

      270db5e70fc36d9c5452728a9e0d1d5cb80e727720c04622bd84b00c5ffd7368c3c55737eb855e2b6cb7e112af42934a41c592f3586fe89bf5006ada8aa8aec3

    Score
    10/10
    neshtapersistencespyware

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks