Overview

overview

10

Static

static

d875927c5a...05.exe

windows7_x64

10

d875927c5a...05.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d875927c5abbd6a123fd863a39add1cf9c9afba520909090065c0aea2d46ce05

  • Size

    1.8MB

  • Sample

    220205-ecp6qsgcbq

  • MD5

    915272c2cb1a64cfdcd587fde3e5b4b2

  • SHA1

    7fcb321379733ca7e449f9f5fe29e3eacd9e39d9

  • SHA256

    d875927c5abbd6a123fd863a39add1cf9c9afba520909090065c0aea2d46ce05

  • SHA512

    8a2b70ab78968bee05afcb789aded3646b3ed68f95b2ce710e5e4a33ddc689551a23d790eaad5ea7bea2fcd0b4edbb56888644df9c4327653a79bfa20338b650

Score
10/10
neshtaevasionpersistencespywarestealer

Malware Config

Targets

    • Target

      d875927c5abbd6a123fd863a39add1cf9c9afba520909090065c0aea2d46ce05

    • Size

      1.8MB

    • MD5

      915272c2cb1a64cfdcd587fde3e5b4b2

    • SHA1

      7fcb321379733ca7e449f9f5fe29e3eacd9e39d9

    • SHA256

      d875927c5abbd6a123fd863a39add1cf9c9afba520909090065c0aea2d46ce05

    • SHA512

      8a2b70ab78968bee05afcb789aded3646b3ed68f95b2ce710e5e4a33ddc689551a23d790eaad5ea7bea2fcd0b4edbb56888644df9c4327653a79bfa20338b650

    Score
    10/10
    neshtaevasionpersistencespywarestealer

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks