Overview

overview

10

Static

static

10

c0b34699cc...a7.exe

windows7_x64

10

c0b34699cc...a7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0b34699cc918492de5e13424d868cdd0c58ea200014e9177c034ea7aed445a7

  • Size

    1.0MB

  • Sample

    220525-cpzvlabfhj

  • MD5

    65e64787c3fc13d199320862c76f55dc

  • SHA1

    3a2bf04bae0bd5bb0f0666b8a8a77a3eef51fd9e

  • SHA256

    c0b34699cc918492de5e13424d868cdd0c58ea200014e9177c034ea7aed445a7

  • SHA512

    8c5782386b655fff09e8bcff39ea89f1cb061b39789a7aef17a5f57f41a55c553fd076428b21483c281ded0fa178516bad9499cfc22a529ef996e7e73d14b591

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      c0b34699cc918492de5e13424d868cdd0c58ea200014e9177c034ea7aed445a7

    • Size

      1.0MB

    • MD5

      65e64787c3fc13d199320862c76f55dc

    • SHA1

      3a2bf04bae0bd5bb0f0666b8a8a77a3eef51fd9e

    • SHA256

      c0b34699cc918492de5e13424d868cdd0c58ea200014e9177c034ea7aed445a7

    • SHA512

      8c5782386b655fff09e8bcff39ea89f1cb061b39789a7aef17a5f57f41a55c553fd076428b21483c281ded0fa178516bad9499cfc22a529ef996e7e73d14b591

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks