Overview

overview

10

Static

static

10

949d7e82a7...a7.exe

windows7_x64

10

949d7e82a7...a7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    949d7e82a7f42722bbc6c9321cc7f3571a9d7a588940bd7b5c70f990efa5c9a7

  • Size

    1.6MB

  • Sample

    220206-mqtebahfbp

  • MD5

    838676667f106c54e351920ca2ee5217

  • SHA1

    3562c96f17e90d1d07c900b08f99dcbc9611c103

  • SHA256

    949d7e82a7f42722bbc6c9321cc7f3571a9d7a588940bd7b5c70f990efa5c9a7

  • SHA512

    f405701f4463d57cf951a8959def290942217b7228aa5d770f78afceab233e7c1ef8a7ee7b08367eb682d270dfb515340f858678ee87f5d29c8c365df722e323

Score
10/10
neshtaevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      949d7e82a7f42722bbc6c9321cc7f3571a9d7a588940bd7b5c70f990efa5c9a7

    • Size

      1.6MB

    • MD5

      838676667f106c54e351920ca2ee5217

    • SHA1

      3562c96f17e90d1d07c900b08f99dcbc9611c103

    • SHA256

      949d7e82a7f42722bbc6c9321cc7f3571a9d7a588940bd7b5c70f990efa5c9a7

    • SHA512

      f405701f4463d57cf951a8959def290942217b7228aa5d770f78afceab233e7c1ef8a7ee7b08367eb682d270dfb515340f858678ee87f5d29c8c365df722e323

    Score
    10/10
    neshtaevasionpersistencespywarestealertrojan

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks