Overview

overview

10

Static

static

10

6faa6b7040...58.exe

windows7_x64

10

6faa6b7040...58.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6faa6b70401bda86a53e85c24e767fb918206a83d365ce6e7dcf4df7b3982b58

  • Size

    694KB

  • Sample

    220524-czgrrscec9

  • MD5

    379a1a8ee773f5cac581582ecb564edf

  • SHA1

    0bbc529e9f65ddc70adb582fd4f637de5c5a57c1

  • SHA256

    6faa6b70401bda86a53e85c24e767fb918206a83d365ce6e7dcf4df7b3982b58

  • SHA512

    86b5ecf17982169f138cd43839654551ad2148d34fdd99af04397b807895aee89de44c17e26272046fa0cafea99e034894f43ecdca76d0401449ecd81c4ebb61

Score
10/10
neshtapersistencespyware

Malware Config

Targets

    • Target

      6faa6b70401bda86a53e85c24e767fb918206a83d365ce6e7dcf4df7b3982b58

    • Size

      694KB

    • MD5

      379a1a8ee773f5cac581582ecb564edf

    • SHA1

      0bbc529e9f65ddc70adb582fd4f637de5c5a57c1

    • SHA256

      6faa6b70401bda86a53e85c24e767fb918206a83d365ce6e7dcf4df7b3982b58

    • SHA512

      86b5ecf17982169f138cd43839654551ad2148d34fdd99af04397b807895aee89de44c17e26272046fa0cafea99e034894f43ecdca76d0401449ecd81c4ebb61

    Score
    10/10
    neshtapersistencespyware

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks