Overview

overview

10

Static

static

1

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    511f5c0a9946188ad3dbbb58c2e2e5564402d83dd77379a39c8a17c660a737da

  • Size

    238KB

  • Sample

    211022-hfbdjabbg9

  • MD5

    8efc94a68d078ed67459403c868aa9f0

  • SHA1

    64da6737b14dc11fb68fe4aef22981219ecbfd9f

  • SHA256

    511f5c0a9946188ad3dbbb58c2e2e5564402d83dd77379a39c8a17c660a737da

  • SHA512

    5fd1f0fb7113d11e5ee7921581da43a4b04c2afeecca9fbd623cae5ef2b19955cd456fd7ac230eeab344e12e6452b780f616b90a00ccc1f1606a443a54f5a9f6

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      511f5c0a9946188ad3dbbb58c2e2e5564402d83dd77379a39c8a17c660a737da

    • Size

      238KB

    • MD5

      8efc94a68d078ed67459403c868aa9f0

    • SHA1

      64da6737b14dc11fb68fe4aef22981219ecbfd9f

    • SHA256

      511f5c0a9946188ad3dbbb58c2e2e5564402d83dd77379a39c8a17c660a737da

    • SHA512

      5fd1f0fb7113d11e5ee7921581da43a4b04c2afeecca9fbd623cae5ef2b19955cd456fd7ac230eeab344e12e6452b780f616b90a00ccc1f1606a443a54f5a9f6

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks