Overview

overview

10

Static

static

10

1601e9f8bb...6d.exe

windows7_x64

10

1601e9f8bb...6d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1601e9f8bb742e3825fb8ec13c5d8b02b629c311d9bdb16f7e7a17c0effb406d

  • Size

    955KB

  • Sample

    220523-3vgjbaaad7

  • MD5

    d1dd59921e2e6773a872f346cd1e9dfc

  • SHA1

    bf377ae3c89dee686d330399432baa78912046c1

  • SHA256

    1601e9f8bb742e3825fb8ec13c5d8b02b629c311d9bdb16f7e7a17c0effb406d

  • SHA512

    1033118ce41dc6cf4ca0f75166455cae4e32630631cf81c57ff1bbd483d9e927c649e7914f176bff239a65e3f5c8021aa881f682adf33f1143a273d2b06040f7

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      1601e9f8bb742e3825fb8ec13c5d8b02b629c311d9bdb16f7e7a17c0effb406d

    • Size

      955KB

    • MD5

      d1dd59921e2e6773a872f346cd1e9dfc

    • SHA1

      bf377ae3c89dee686d330399432baa78912046c1

    • SHA256

      1601e9f8bb742e3825fb8ec13c5d8b02b629c311d9bdb16f7e7a17c0effb406d

    • SHA512

      1033118ce41dc6cf4ca0f75166455cae4e32630631cf81c57ff1bbd483d9e927c649e7914f176bff239a65e3f5c8021aa881f682adf33f1143a273d2b06040f7

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks