Overview

overview

10

Static

static

fb7c52dc15...a7.exe

windows7_x64

10

fb7c52dc15...a7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb7c52dc15715a6a827f9809ed4a35ee50d2fe426212310ec756c608a86b92a7

  • Size

    599KB

  • Sample

    220219-zh861sdac2

  • MD5

    fcf48dccf23b377f273e8de9ac0e930c

  • SHA1

    551f15568a81ecf273d25623a0e9cd71be2ad0ca

  • SHA256

    fb7c52dc15715a6a827f9809ed4a35ee50d2fe426212310ec756c608a86b92a7

  • SHA512

    b334dd842f154c396f387dc943299cede0439505443b7f2f674c7e2e50f9937238469f157d008c840c2563639c1c9401df7982564b37225afe28398f5cb159e6

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      fb7c52dc15715a6a827f9809ed4a35ee50d2fe426212310ec756c608a86b92a7

    • Size

      599KB

    • MD5

      fcf48dccf23b377f273e8de9ac0e930c

    • SHA1

      551f15568a81ecf273d25623a0e9cd71be2ad0ca

    • SHA256

      fb7c52dc15715a6a827f9809ed4a35ee50d2fe426212310ec756c608a86b92a7

    • SHA512

      b334dd842f154c396f387dc943299cede0439505443b7f2f674c7e2e50f9937238469f157d008c840c2563639c1c9401df7982564b37225afe28398f5cb159e6

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks