Overview

overview

10

Static

static

10

22e7887587...ac.exe

windows7_x64

10

22e7887587...ac.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22e788758780548556950230a7bd941381bb0d5a8fd6ba12bfd40743d41f38ac

  • Size

    210KB

  • Sample

    220524-bhlhysbbg6

  • MD5

    ad08ee1a5f795d46b6a89f1a3562bba3

  • SHA1

    8f6477223d3d8d64e79f13d52fb512f453df7191

  • SHA256

    22e788758780548556950230a7bd941381bb0d5a8fd6ba12bfd40743d41f38ac

  • SHA512

    840d28ba3230fd0ab029104126ff3b91844bde26a5d0c7770b0da3861cf3160948c85133fadc9c20b1f156660efec6a73261c824c561eff4d937dd920f7c7162

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      22e788758780548556950230a7bd941381bb0d5a8fd6ba12bfd40743d41f38ac

    • Size

      210KB

    • MD5

      ad08ee1a5f795d46b6a89f1a3562bba3

    • SHA1

      8f6477223d3d8d64e79f13d52fb512f453df7191

    • SHA256

      22e788758780548556950230a7bd941381bb0d5a8fd6ba12bfd40743d41f38ac

    • SHA512

      840d28ba3230fd0ab029104126ff3b91844bde26a5d0c7770b0da3861cf3160948c85133fadc9c20b1f156660efec6a73261c824c561eff4d937dd920f7c7162

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks