Overview

overview

10

Static

static

10

tmp.exe

windows7_x64

10

tmp.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    377KB

  • Sample

    220529-k1zb7sdee6

  • MD5

    c547b83eb19d7b7f3b452bb00f3af774

  • SHA1

    9aa5a18b9cfaeccc91fe7f4d8015c10ed44bce92

  • SHA256

    741d106ef5db0d61b16df07eecb4054c432c2e152c25d3d3b6512148de1049ac

  • SHA512

    f3796167ba7fbc3f5d178da3588e2987cabc54c33b10d1bc5fd8cd24237bd972eac6b43c38bc1588828a8ca0f53cd328c5c591f6d2488319a9a26e9ac4a95442

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      tmp

    • Size

      377KB

    • MD5

      c547b83eb19d7b7f3b452bb00f3af774

    • SHA1

      9aa5a18b9cfaeccc91fe7f4d8015c10ed44bce92

    • SHA256

      741d106ef5db0d61b16df07eecb4054c432c2e152c25d3d3b6512148de1049ac

    • SHA512

      f3796167ba7fbc3f5d178da3588e2987cabc54c33b10d1bc5fd8cd24237bd972eac6b43c38bc1588828a8ca0f53cd328c5c591f6d2488319a9a26e9ac4a95442

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks