Overview

overview

10

Static

static

10

d2763354cb...91.exe

windows7_x64

10

d2763354cb...91.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2763354cb62b10e0f9663258bc9b66f2366d9d97871b06677cf74e518044991

  • Size

    1.3MB

  • Sample

    220524-dv5hpshcdm

  • MD5

    a8eac6008d1e402092777e2b4873b4a8

  • SHA1

    8e6506636fe11f71fa9e09a1b3e9653756304ad9

  • SHA256

    d2763354cb62b10e0f9663258bc9b66f2366d9d97871b06677cf74e518044991

  • SHA512

    43447858f50b210db06056d71a68d52d6e250ab50e098ab19519acd059be46995594d834cd974ac691e85baabb3353530ebf5cb64c0f413384d3d6248cdd2257

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      d2763354cb62b10e0f9663258bc9b66f2366d9d97871b06677cf74e518044991

    • Size

      1.3MB

    • MD5

      a8eac6008d1e402092777e2b4873b4a8

    • SHA1

      8e6506636fe11f71fa9e09a1b3e9653756304ad9

    • SHA256

      d2763354cb62b10e0f9663258bc9b66f2366d9d97871b06677cf74e518044991

    • SHA512

      43447858f50b210db06056d71a68d52d6e250ab50e098ab19519acd059be46995594d834cd974ac691e85baabb3353530ebf5cb64c0f413384d3d6248cdd2257

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks