Overview

overview

10

Static

static

10

26fc5ebcb8...02.exe

windows7_x64

10

26fc5ebcb8...02.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26fc5ebcb8ae884a5c536b83960e500d87ec8650c4f60346c24591a7afd73902

  • Size

    1.6MB

  • Sample

    220206-rghnnsage8

  • MD5

    2630efe8a8a69405a9286eebada3245a

  • SHA1

    b73f5ceef5b4bde8d78798539dbfa79274121d9a

  • SHA256

    26fc5ebcb8ae884a5c536b83960e500d87ec8650c4f60346c24591a7afd73902

  • SHA512

    90be1d776db6dd13c64557af39df70a30a345e23b9e4b1034512815cf5d87d78406b20984106f0e2567db1793b25aaab2fc27d37469d1151c3137b89c7038275

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      26fc5ebcb8ae884a5c536b83960e500d87ec8650c4f60346c24591a7afd73902

    • Size

      1.6MB

    • MD5

      2630efe8a8a69405a9286eebada3245a

    • SHA1

      b73f5ceef5b4bde8d78798539dbfa79274121d9a

    • SHA256

      26fc5ebcb8ae884a5c536b83960e500d87ec8650c4f60346c24591a7afd73902

    • SHA512

      90be1d776db6dd13c64557af39df70a30a345e23b9e4b1034512815cf5d87d78406b20984106f0e2567db1793b25aaab2fc27d37469d1151c3137b89c7038275

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks