Overview

overview

10

Static

static

10

359b201b01...59.exe

windows7_x64

10

359b201b01...59.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59

  • Size

    112KB

  • Sample

    220207-dh5myaeefq

  • MD5

    8b7611f961f0e2654905ef70c64643d8

  • SHA1

    6179240e198d9cb07b2703be0b725f852303cc97

  • SHA256

    359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59

  • SHA512

    708e2ba0d0703e0b392654f928b9c0f478d86a60be9568a0bc9bb080a21ee32fed24d8cdedfe1c6e6651918af6d13a0f23e730c40ae038448d99bcf728195737

Score
10/10
neshtaevasionpersistencespywarestealer

Malware Config

Targets

    • Target

      359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59

    • Size

      112KB

    • MD5

      8b7611f961f0e2654905ef70c64643d8

    • SHA1

      6179240e198d9cb07b2703be0b725f852303cc97

    • SHA256

      359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59

    • SHA512

      708e2ba0d0703e0b392654f928b9c0f478d86a60be9568a0bc9bb080a21ee32fed24d8cdedfe1c6e6651918af6d13a0f23e730c40ae038448d99bcf728195737

    Score
    10/10
    neshtaevasionpersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks