Overview

overview

10

Static

static

10

cedb4944b4...a1.exe

windows7_x64

10

cedb4944b4...a1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1

  • Size

    1.4MB

  • Sample

    220206-kjr7kaghd9

  • MD5

    f86baa5f7ec577a266f56c03882a3777

  • SHA1

    93b59618c52a95d397e8d0648645be54e2b46f40

  • SHA256

    cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1

  • SHA512

    96eeedd87f68f2ff2c645bcf040fa7140db2451ec23a495b69c0a4d84461d65922995c02021a5ea7a3ebad51b5bcf9b0549fc96b7537b8e59aaf59cd5222f10e

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1

    • Size

      1.4MB

    • MD5

      f86baa5f7ec577a266f56c03882a3777

    • SHA1

      93b59618c52a95d397e8d0648645be54e2b46f40

    • SHA256

      cedb4944b45554e9343777da0fb3696f857bf5b319d4f73d9e20a8f8f96cdca1

    • SHA512

      96eeedd87f68f2ff2c645bcf040fa7140db2451ec23a495b69c0a4d84461d65922995c02021a5ea7a3ebad51b5bcf9b0549fc96b7537b8e59aaf59cd5222f10e

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks