Overview

overview

10

Static

static

10

d470edc200...fe.exe

windows7_x64

10

d470edc200...fe.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d470edc2001f7d2bf7542555aeb1d63adb44d9f7903f743162d2c37649c281fe

  • Size

    7.1MB

  • Sample

    220524-azvbradgam

  • MD5

    7df158c7f217c271b9584ca3580ea910

  • SHA1

    e336f13dc4f77ec99e49658f937b9774a27a97f5

  • SHA256

    d470edc2001f7d2bf7542555aeb1d63adb44d9f7903f743162d2c37649c281fe

  • SHA512

    cf8a24876d390fee2a601d1a094bb37613a54173dec20d066c70c068eaa28e6727f742465d532100d1d0c09a572450d76757f54a7c2b89c81b0f1cccce3bdb9d

Score
10/10
neshtapersistencepyinstallerspywarestealer

Malware Config

Targets

    • Target

      d470edc2001f7d2bf7542555aeb1d63adb44d9f7903f743162d2c37649c281fe

    • Size

      7.1MB

    • MD5

      7df158c7f217c271b9584ca3580ea910

    • SHA1

      e336f13dc4f77ec99e49658f937b9774a27a97f5

    • SHA256

      d470edc2001f7d2bf7542555aeb1d63adb44d9f7903f743162d2c37649c281fe

    • SHA512

      cf8a24876d390fee2a601d1a094bb37613a54173dec20d066c70c068eaa28e6727f742465d532100d1d0c09a572450d76757f54a7c2b89c81b0f1cccce3bdb9d

    Score
    10/10
    neshtapersistencepyinstallerspywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks