Overview

overview

10

Static

static

PO#6018634905996.exe

windows7_x64

10

PO#6018634905996.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO#6018634905996.exe

  • Size

    627KB

  • Sample

    211118-hn8c8sbgej

  • MD5

    9cdeb7a57e0b78f5a7b7d79e557d3dfe

  • SHA1

    07eb1aea9e88b5edb608bc2fe66da0fc9199f3bd

  • SHA256

    a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec

  • SHA512

    c7bce9f8e98f34b26bfcf6c61b38a99d3b160a8cdfb3502b6468bfc634298ea370b329918bd75ed6aeafbba339e207d1ffbe8d1f4cc94d15e3348764f35e7de1

Score
10/10
neshtaevasionpersistencespywarestealer

Malware Config

Targets

    • Target

      PO#6018634905996.exe

    • Size

      627KB

    • MD5

      9cdeb7a57e0b78f5a7b7d79e557d3dfe

    • SHA1

      07eb1aea9e88b5edb608bc2fe66da0fc9199f3bd

    • SHA256

      a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec

    • SHA512

      c7bce9f8e98f34b26bfcf6c61b38a99d3b160a8cdfb3502b6468bfc634298ea370b329918bd75ed6aeafbba339e207d1ffbe8d1f4cc94d15e3348764f35e7de1

    Score
    10/10
    neshtaevasionpersistencespywarestealer

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks