Overview

overview

10

Static

static

10

bc85cf5459...74.exe

windows7_x64

10

bc85cf5459...74.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc85cf54592e1aaed718075fc8216a114f3848ce1eef5da6b40de761a3a32574

  • Size

    471KB

  • Sample

    220206-kyjtqshad9

  • MD5

    6a2ce11c38d1dbe2057ea8ab193450f9

  • SHA1

    2146da22cb07e2c2416a65710517ae8ecd05ece3

  • SHA256

    bc85cf54592e1aaed718075fc8216a114f3848ce1eef5da6b40de761a3a32574

  • SHA512

    1cd44daa13f11788e53914ffcf1fc57f14a29c754260b80e061e88fa798665875b41f843a51897c63c979c10a50694f534cdd7e9b15ff46cede84cb17e2e736e

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      bc85cf54592e1aaed718075fc8216a114f3848ce1eef5da6b40de761a3a32574

    • Size

      471KB

    • MD5

      6a2ce11c38d1dbe2057ea8ab193450f9

    • SHA1

      2146da22cb07e2c2416a65710517ae8ecd05ece3

    • SHA256

      bc85cf54592e1aaed718075fc8216a114f3848ce1eef5da6b40de761a3a32574

    • SHA512

      1cd44daa13f11788e53914ffcf1fc57f14a29c754260b80e061e88fa798665875b41f843a51897c63c979c10a50694f534cdd7e9b15ff46cede84cb17e2e736e

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks