Overview

overview

10

Static

static

13a1c548ab...fe.exe

windows7_x64

10

13a1c548ab...fe.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13a1c548abf86e0c908fdeca6fb315fe

  • Size

    1009KB

  • Sample

    211008-kbvygsdgfp

  • MD5

    13a1c548abf86e0c908fdeca6fb315fe

  • SHA1

    c2988a93906cffd63704990194eb9b3ba556a209

  • SHA256

    42b3efec41088a0afd2cc17e038169dd572baa116aa734a427012d39917f4107

  • SHA512

    db1b2013853fcad8c54337af2cb42f1c54a0b73cf438475e58d799a0623808686ca5100f275de8d90d3169747e0ed3ee132bca720c0e04eea565c33fde58a50d

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      13a1c548abf86e0c908fdeca6fb315fe

    • Size

      1009KB

    • MD5

      13a1c548abf86e0c908fdeca6fb315fe

    • SHA1

      c2988a93906cffd63704990194eb9b3ba556a209

    • SHA256

      42b3efec41088a0afd2cc17e038169dd572baa116aa734a427012d39917f4107

    • SHA512

      db1b2013853fcad8c54337af2cb42f1c54a0b73cf438475e58d799a0623808686ca5100f275de8d90d3169747e0ed3ee132bca720c0e04eea565c33fde58a50d

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks