Overview

overview

10

Static

static

10

mbr.exe

windows7_x64

10

mbr.exe

windows10_x64

10

mbr.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mbr.exe

  • Size

    88KB

  • Sample

    220526-nw17sabag6

  • MD5

    6341e20beb1eac54d1cd968827480256

  • SHA1

    002bd68aa065be59a27839113a4345ecf9e06190

  • SHA256

    d6aad97edc9eea7eb5b9ce013c8350c48787dbc7753318832ad0be425b2be2ee

  • SHA512

    2c83f1bdb2559888bcee7683bb902c6da8d4c9f1682aa5bc8b0975ee4eb65a53dac7325a00095db297f0ca3ee236046cfaf784fff338f187690f0f04d5e0e53d

Score
10/10
neshtabootkitpersistencespywarestealer

Malware Config

Targets

    • Target

      mbr.exe

    • Size

      88KB

    • MD5

      6341e20beb1eac54d1cd968827480256

    • SHA1

      002bd68aa065be59a27839113a4345ecf9e06190

    • SHA256

      d6aad97edc9eea7eb5b9ce013c8350c48787dbc7753318832ad0be425b2be2ee

    • SHA512

      2c83f1bdb2559888bcee7683bb902c6da8d4c9f1682aa5bc8b0975ee4eb65a53dac7325a00095db297f0ca3ee236046cfaf784fff338f187690f0f04d5e0e53d

    Score
    10/10
    neshtabootkitpersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v6

Tasks