Overview

overview

10

Static

static

10

2283eba55b...e4.exe

windows7_x64

10

2283eba55b...e4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2283eba55b722639287a446420f65f0161bb89b10d27136281b57381384e5ce4

  • Size

    911KB

  • Sample

    220222-npf82ahddm

  • MD5

    00c22062ab8d4bf5afb577c55d3803bb

  • SHA1

    1e3bb2c4c9def27a96133d6c9e9770c568ed7d77

  • SHA256

    2283eba55b722639287a446420f65f0161bb89b10d27136281b57381384e5ce4

  • SHA512

    2980e46559cfa57f1c39d67eb8e231463f96deb6e5d7f1c5cabe974a3daf0c30c90e644639e28e2c805192f3b70963947c2a991d1c4ceacacdbb6a3e2369aaf0

Score
10/10
neshtapersistencespyware

Malware Config

Targets

    • Target

      2283eba55b722639287a446420f65f0161bb89b10d27136281b57381384e5ce4

    • Size

      911KB

    • MD5

      00c22062ab8d4bf5afb577c55d3803bb

    • SHA1

      1e3bb2c4c9def27a96133d6c9e9770c568ed7d77

    • SHA256

      2283eba55b722639287a446420f65f0161bb89b10d27136281b57381384e5ce4

    • SHA512

      2980e46559cfa57f1c39d67eb8e231463f96deb6e5d7f1c5cabe974a3daf0c30c90e644639e28e2c805192f3b70963947c2a991d1c4ceacacdbb6a3e2369aaf0

    Score
    10/10
    neshtapersistencespyware

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks