Overview

overview

10

Static

static

10

bcb1978058...5d.exe

windows7_x64

10

bcb1978058...5d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bcb19780586876f65b66d087ea718578ee54eda851e08f5c0c77aa40edcb095d

  • Size

    1.7MB

  • Sample

    220204-qqgx3aadf9

  • MD5

    d9dc29569346da13c52a5bba969c0122

  • SHA1

    4fb444c4c3b4d4d060b18fd7c8dabe9cf172982d

  • SHA256

    bcb19780586876f65b66d087ea718578ee54eda851e08f5c0c77aa40edcb095d

  • SHA512

    6a9419ccda85c924f6afe3d84bdacc1eedd535ea48a5472afd356067285e8aa515940baf809dd82c248580577bc87312053779553a5eedee0764861af6e492e4

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      bcb19780586876f65b66d087ea718578ee54eda851e08f5c0c77aa40edcb095d

    • Size

      1.7MB

    • MD5

      d9dc29569346da13c52a5bba969c0122

    • SHA1

      4fb444c4c3b4d4d060b18fd7c8dabe9cf172982d

    • SHA256

      bcb19780586876f65b66d087ea718578ee54eda851e08f5c0c77aa40edcb095d

    • SHA512

      6a9419ccda85c924f6afe3d84bdacc1eedd535ea48a5472afd356067285e8aa515940baf809dd82c248580577bc87312053779553a5eedee0764861af6e492e4

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks