Overview

overview

10

Static

static

10

2c13b8c34c...ea.exe

windows7_x64

10

2c13b8c34c...ea.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c13b8c34c88eff2deacd8d3b4e7b0756312db18e152b9cf0209ab8da2a49aea

  • Size

    6.6MB

  • Sample

    220523-1fdsrscfbm

  • MD5

    ea3dba5d30f010ad8c85fb960b1eda4a

  • SHA1

    b558dfa5ffbf9c5318f22833019d923dd606bf2d

  • SHA256

    2c13b8c34c88eff2deacd8d3b4e7b0756312db18e152b9cf0209ab8da2a49aea

  • SHA512

    6666d57203d5b92db3af9a40ff22e6a3fb717753f0d3291bd0dfe244ab1a71a4b766bbc6d454b173a1fb389bd58e636ee2f0144ac35c25efabbb6802dc944619

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      2c13b8c34c88eff2deacd8d3b4e7b0756312db18e152b9cf0209ab8da2a49aea

    • Size

      6.6MB

    • MD5

      ea3dba5d30f010ad8c85fb960b1eda4a

    • SHA1

      b558dfa5ffbf9c5318f22833019d923dd606bf2d

    • SHA256

      2c13b8c34c88eff2deacd8d3b4e7b0756312db18e152b9cf0209ab8da2a49aea

    • SHA512

      6666d57203d5b92db3af9a40ff22e6a3fb717753f0d3291bd0dfe244ab1a71a4b766bbc6d454b173a1fb389bd58e636ee2f0144ac35c25efabbb6802dc944619

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks