Overview

overview

10

Static

static

10

477da3de29...ae.exe

windows7_x64

10

477da3de29...ae.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    477da3de29bd783eabe881d4d89783c7aed7be37dd638158c5159059a393caae

  • Size

    989KB

  • Sample

    220129-krmbaahbf3

  • MD5

    126bb7728451d48e27e7782079b2b960

  • SHA1

    629e21956b05f45f2cd5665779f27c847aa2f14d

  • SHA256

    477da3de29bd783eabe881d4d89783c7aed7be37dd638158c5159059a393caae

  • SHA512

    bdffe9d20ae79b35975b45afb7a11d131dbdb4f5ed2b20625d7d968fc8882de5372406c79436b1ba122d4521636cda4534d3722dced4a05b283258ed8656f0d1

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      477da3de29bd783eabe881d4d89783c7aed7be37dd638158c5159059a393caae

    • Size

      989KB

    • MD5

      126bb7728451d48e27e7782079b2b960

    • SHA1

      629e21956b05f45f2cd5665779f27c847aa2f14d

    • SHA256

      477da3de29bd783eabe881d4d89783c7aed7be37dd638158c5159059a393caae

    • SHA512

      bdffe9d20ae79b35975b45afb7a11d131dbdb4f5ed2b20625d7d968fc8882de5372406c79436b1ba122d4521636cda4534d3722dced4a05b283258ed8656f0d1

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks