Overview

overview

10

Static

static

10

f3864ddf9a...77.exe

windows7_x64

10

f3864ddf9a...77.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3864ddf9a58596b029eb53dac9459e3d5bd41afa9a1d3f3dc3700b97d93f077

  • Size

    3.1MB

  • Sample

    220525-bq72xshhfj

  • MD5

    a682b0e14769e304bb8c3fbe35388d4b

  • SHA1

    ad4c679eff8184a33d3dd9f861653511e1eff404

  • SHA256

    f3864ddf9a58596b029eb53dac9459e3d5bd41afa9a1d3f3dc3700b97d93f077

  • SHA512

    d1f8351aec6b05a8a669f31e10d38d0bcb6d5bff2db1df4f35db4fb115308b2d1c130553732a0484c21de3f537e9f13544174d236b6fd8e83efa8c1850083fc7

Score
10/10
neshtaevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      f3864ddf9a58596b029eb53dac9459e3d5bd41afa9a1d3f3dc3700b97d93f077

    • Size

      3.1MB

    • MD5

      a682b0e14769e304bb8c3fbe35388d4b

    • SHA1

      ad4c679eff8184a33d3dd9f861653511e1eff404

    • SHA256

      f3864ddf9a58596b029eb53dac9459e3d5bd41afa9a1d3f3dc3700b97d93f077

    • SHA512

      d1f8351aec6b05a8a669f31e10d38d0bcb6d5bff2db1df4f35db4fb115308b2d1c130553732a0484c21de3f537e9f13544174d236b6fd8e83efa8c1850083fc7

    Score
    10/10
    neshtaevasionpersistencespywarestealertrojan

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks