Overview

overview

10

Static

static

945e51aca1...3a.exe

windows7_x64

10

945e51aca1...3a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    945e51aca163deb6f5fd0f91a142973623827c03574d3f61bb8fcef3a5f2cc3a

  • Size

    1.5MB

  • Sample

    220206-mq6dwahea9

  • MD5

    f647978963d3f94a26439baade73d753

  • SHA1

    803efd9628480f2a0547ba53ac2b98344137a37d

  • SHA256

    945e51aca163deb6f5fd0f91a142973623827c03574d3f61bb8fcef3a5f2cc3a

  • SHA512

    f43ce5895fed966970a8fc5a453f36d88b748af38de162d187210aac280234fd525448d42ed2149f871f8646e51773a565e03fb71fedf0b6a1bb859b110c457d

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      945e51aca163deb6f5fd0f91a142973623827c03574d3f61bb8fcef3a5f2cc3a

    • Size

      1.5MB

    • MD5

      f647978963d3f94a26439baade73d753

    • SHA1

      803efd9628480f2a0547ba53ac2b98344137a37d

    • SHA256

      945e51aca163deb6f5fd0f91a142973623827c03574d3f61bb8fcef3a5f2cc3a

    • SHA512

      f43ce5895fed966970a8fc5a453f36d88b748af38de162d187210aac280234fd525448d42ed2149f871f8646e51773a565e03fb71fedf0b6a1bb859b110c457d

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks