Overview

overview

10

Static

static

10

efecb98845...18.exe

windows7_x64

10

efecb98845...18.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efecb98845d068cc060eca656b77749b31f6aa32e3f131d825d605df73efeb18

  • Size

    161KB

  • Sample

    220524-a2mdxsdggj

  • MD5

    ad6b22dca4e78432f65eb22471f20539

  • SHA1

    9e149ceb4099a2eb7eff265c866884b782b95f6b

  • SHA256

    efecb98845d068cc060eca656b77749b31f6aa32e3f131d825d605df73efeb18

  • SHA512

    c7ee4aeaeb6ad845ea6c26800b3b7546c39e081976215ea5102146b68762b0bff08ed4198dd10d18c198e23320f9d0814a8dff3c6c6567c24b946ac68b923f37

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      efecb98845d068cc060eca656b77749b31f6aa32e3f131d825d605df73efeb18

    • Size

      161KB

    • MD5

      ad6b22dca4e78432f65eb22471f20539

    • SHA1

      9e149ceb4099a2eb7eff265c866884b782b95f6b

    • SHA256

      efecb98845d068cc060eca656b77749b31f6aa32e3f131d825d605df73efeb18

    • SHA512

      c7ee4aeaeb6ad845ea6c26800b3b7546c39e081976215ea5102146b68762b0bff08ed4198dd10d18c198e23320f9d0814a8dff3c6c6567c24b946ac68b923f37

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks