Overview

overview

10

Static

static

10

9099b614bb...d3.exe

windows7_x64

10

9099b614bb...d3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9099b614bb604ac3d64e821ef27a67891dd6360c81e59b76d6bc5d4c02f7a7d3

  • Size

    259KB

  • Sample

    220524-bg8xvseegj

  • MD5

    47ebf13518a1c18f883b79a47bc5fa39

  • SHA1

    f24d930de5a0414aae91952439a754534ef32019

  • SHA256

    9099b614bb604ac3d64e821ef27a67891dd6360c81e59b76d6bc5d4c02f7a7d3

  • SHA512

    d41db02024a11c696a8bf8f977bd71642ef41cb0407931db6861058e79fcd8fd645304f17a35f4736e9140ea6a8969c0178bf68cb99b424feaa5125ce8935cc5

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      9099b614bb604ac3d64e821ef27a67891dd6360c81e59b76d6bc5d4c02f7a7d3

    • Size

      259KB

    • MD5

      47ebf13518a1c18f883b79a47bc5fa39

    • SHA1

      f24d930de5a0414aae91952439a754534ef32019

    • SHA256

      9099b614bb604ac3d64e821ef27a67891dd6360c81e59b76d6bc5d4c02f7a7d3

    • SHA512

      d41db02024a11c696a8bf8f977bd71642ef41cb0407931db6861058e79fcd8fd645304f17a35f4736e9140ea6a8969c0178bf68cb99b424feaa5125ce8935cc5

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks