Overview

overview

10

Static

static

10

3243a155d0...19.exe

windows7_x64

10

3243a155d0...19.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3243a155d015906d59fdc180be84355f36c7d5316cfa20dd23a5725c412f6819

  • Size

    161KB

  • Sample

    220222-glgxtsdcc4

  • MD5

    01a4c5345cb0e7103cd590236ab8f189

  • SHA1

    6788a3d23362909fbcbee05da1c8c5fdb949db2f

  • SHA256

    3243a155d015906d59fdc180be84355f36c7d5316cfa20dd23a5725c412f6819

  • SHA512

    fc73aa703be0cfd3ece5e97dbe9e64eb602254114d5d19e8cf696778e5955a90590b9049c612ad9f6d10f0268014b16054c945ceb1a554ddb15cae9333ad5532

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      3243a155d015906d59fdc180be84355f36c7d5316cfa20dd23a5725c412f6819

    • Size

      161KB

    • MD5

      01a4c5345cb0e7103cd590236ab8f189

    • SHA1

      6788a3d23362909fbcbee05da1c8c5fdb949db2f

    • SHA256

      3243a155d015906d59fdc180be84355f36c7d5316cfa20dd23a5725c412f6819

    • SHA512

      fc73aa703be0cfd3ece5e97dbe9e64eb602254114d5d19e8cf696778e5955a90590b9049c612ad9f6d10f0268014b16054c945ceb1a554ddb15cae9333ad5532

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks