Overview

overview

10

Static

static

10

d5bc7b3fa3...b4.exe

windows7_x64

10

d5bc7b3fa3...b4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5bc7b3fa35eaea7886d5ce80de499a6a1a2a586644534e5d7917109821371b4

  • Size

    1.3MB

  • Sample

    220129-bhcaaahhan

  • MD5

    d7fc44c40a5ff5e408096719f8804a8f

  • SHA1

    d2a731ce99af6f7d15755822cfb07dc20fd4ad31

  • SHA256

    d5bc7b3fa35eaea7886d5ce80de499a6a1a2a586644534e5d7917109821371b4

  • SHA512

    14832d511636e5dda2efb19d86f9f831d6112dfda6f5c939f6ea69f2f720d5893867084b34c444e5a547c9399971dde5d45339a3b5231fe638186aefd93bcaef

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      d5bc7b3fa35eaea7886d5ce80de499a6a1a2a586644534e5d7917109821371b4

    • Size

      1.3MB

    • MD5

      d7fc44c40a5ff5e408096719f8804a8f

    • SHA1

      d2a731ce99af6f7d15755822cfb07dc20fd4ad31

    • SHA256

      d5bc7b3fa35eaea7886d5ce80de499a6a1a2a586644534e5d7917109821371b4

    • SHA512

      14832d511636e5dda2efb19d86f9f831d6112dfda6f5c939f6ea69f2f720d5893867084b34c444e5a547c9399971dde5d45339a3b5231fe638186aefd93bcaef

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks