Overview

overview

10

Static

static

10

9f435dd076...bb.exe

windows7_x64

10

9f435dd076...bb.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f435dd076aa4bafc2bceacf41192c177970ece149d2393cb0b4ab5281de03bb

  • Size

    2.4MB

  • Sample

    220129-eq4w2scfbk

  • MD5

    57c67d1d99284584c0caeeb4c986eb08

  • SHA1

    bd6bdff5dac86165ec33b5c7dcb639990b33ed14

  • SHA256

    9f435dd076aa4bafc2bceacf41192c177970ece149d2393cb0b4ab5281de03bb

  • SHA512

    2ff29f1631ed94a6f91a0a790da537445b087793582013a552c4f2670d3ddc2908e7f73f44d41fa9ec83e304dffba78071f64df1d7c023836023253c27bc1084

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      9f435dd076aa4bafc2bceacf41192c177970ece149d2393cb0b4ab5281de03bb

    • Size

      2.4MB

    • MD5

      57c67d1d99284584c0caeeb4c986eb08

    • SHA1

      bd6bdff5dac86165ec33b5c7dcb639990b33ed14

    • SHA256

      9f435dd076aa4bafc2bceacf41192c177970ece149d2393cb0b4ab5281de03bb

    • SHA512

      2ff29f1631ed94a6f91a0a790da537445b087793582013a552c4f2670d3ddc2908e7f73f44d41fa9ec83e304dffba78071f64df1d7c023836023253c27bc1084

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks