Overview

overview

10

Static

static

10

fbe78a7e77...d8.exe

windows7_x64

10

fbe78a7e77...d8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fbe78a7e77ab86fb92c03d04108a7c94914d73bc019a7a4639acdcf6180bdad8

  • Size

    832KB

  • Sample

    220206-h94l6sgdf8

  • MD5

    d3b8e0b1721a5760d4abd6ec90ee245b

  • SHA1

    93c129ee45f0622a4acbc1cee93113b6dfc0d4c1

  • SHA256

    fbe78a7e77ab86fb92c03d04108a7c94914d73bc019a7a4639acdcf6180bdad8

  • SHA512

    bb9909737ebccb2088fd6119dad4f91bc5c5ff5e48d4a4b0ef180ed7e86f3d6d2325b7598a27c490ea17600b7702876cc9f72485cea81b633be31d6f2a5e665b

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      fbe78a7e77ab86fb92c03d04108a7c94914d73bc019a7a4639acdcf6180bdad8

    • Size

      832KB

    • MD5

      d3b8e0b1721a5760d4abd6ec90ee245b

    • SHA1

      93c129ee45f0622a4acbc1cee93113b6dfc0d4c1

    • SHA256

      fbe78a7e77ab86fb92c03d04108a7c94914d73bc019a7a4639acdcf6180bdad8

    • SHA512

      bb9909737ebccb2088fd6119dad4f91bc5c5ff5e48d4a4b0ef180ed7e86f3d6d2325b7598a27c490ea17600b7702876cc9f72485cea81b633be31d6f2a5e665b

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks