Overview

overview

10

Static

static

10

07ff472712...36.exe

windows7_x64

10

07ff472712...36.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07ff47271239c36af0ebf113784fce65e060ad3cbfe815d4e56551af9d718a36

  • Size

    144KB

  • Sample

    220222-2dfp1seeg2

  • MD5

    f2101b30385169f1fd74118d43f96baa

  • SHA1

    cd4fcdf8b0fa47606799f63679e1ac9ab2b2d624

  • SHA256

    07ff47271239c36af0ebf113784fce65e060ad3cbfe815d4e56551af9d718a36

  • SHA512

    2240fb2f7e1895bdc02b3fe00a0fe9b39a2336bac45d73b892ecc52738cd1dc406967f1d8eae2ba6a685620f6d9bd7d0a137f5874371ad370e00441f869f7471

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      07ff47271239c36af0ebf113784fce65e060ad3cbfe815d4e56551af9d718a36

    • Size

      144KB

    • MD5

      f2101b30385169f1fd74118d43f96baa

    • SHA1

      cd4fcdf8b0fa47606799f63679e1ac9ab2b2d624

    • SHA256

      07ff47271239c36af0ebf113784fce65e060ad3cbfe815d4e56551af9d718a36

    • SHA512

      2240fb2f7e1895bdc02b3fe00a0fe9b39a2336bac45d73b892ecc52738cd1dc406967f1d8eae2ba6a685620f6d9bd7d0a137f5874371ad370e00441f869f7471

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks