Overview

overview

10

Static

static

8bd82d437b...b7.exe

windows7_x64

10

8bd82d437b...b7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bd82d437b13ee1bc78de6ccb2938095f0d4bda74ffa3ccb8333bfe3c6c8a5b7

  • Size

    95KB

  • Sample

    220213-pntneabggj

  • MD5

    c732bba9b388eab6da3faa863961b111

  • SHA1

    537359edbcaa687cacf3fcc68a4ef96dbb7e9422

  • SHA256

    8bd82d437b13ee1bc78de6ccb2938095f0d4bda74ffa3ccb8333bfe3c6c8a5b7

  • SHA512

    9a1672f19a976ba41330a4023ff9c213caf91c7ff8a6f0a0db246d9846b98f11fd533261456abe7fbc0ffabab755d1d9e8477dc7ad55ee407a1b198d913b6f81

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      8bd82d437b13ee1bc78de6ccb2938095f0d4bda74ffa3ccb8333bfe3c6c8a5b7

    • Size

      95KB

    • MD5

      c732bba9b388eab6da3faa863961b111

    • SHA1

      537359edbcaa687cacf3fcc68a4ef96dbb7e9422

    • SHA256

      8bd82d437b13ee1bc78de6ccb2938095f0d4bda74ffa3ccb8333bfe3c6c8a5b7

    • SHA512

      9a1672f19a976ba41330a4023ff9c213caf91c7ff8a6f0a0db246d9846b98f11fd533261456abe7fbc0ffabab755d1d9e8477dc7ad55ee407a1b198d913b6f81

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks