Overview

overview

10

Static

static

10

b16522c76d...ew.exe

windows7_x64

10

b16522c76d...ew.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b16522c76d4129c5381c2568b1e31581_5-NS new.exe

  • Size

    165KB

  • Sample

    220216-g5wv4abch9

  • MD5

    b16522c76d4129c5381c2568b1e31581

  • SHA1

    6fa7e62cf9aa3264298ff58d75fa505cd5bf583e

  • SHA256

    21f78b4d9829db5e3e7d21ff3ad03991b9d00df9d05518ff49b8cdfb2d46e282

  • SHA512

    e58be82fa8d181644a6c50606c0e32ec0020e9b26eb84f2e58c37c2ba5f0f0c831a46700789a3f95480402cb923498604371f760efb135926eae9be3ce257e48

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      b16522c76d4129c5381c2568b1e31581_5-NS new.exe

    • Size

      165KB

    • MD5

      b16522c76d4129c5381c2568b1e31581

    • SHA1

      6fa7e62cf9aa3264298ff58d75fa505cd5bf583e

    • SHA256

      21f78b4d9829db5e3e7d21ff3ad03991b9d00df9d05518ff49b8cdfb2d46e282

    • SHA512

      e58be82fa8d181644a6c50606c0e32ec0020e9b26eb84f2e58c37c2ba5f0f0c831a46700789a3f95480402cb923498604371f760efb135926eae9be3ce257e48

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks