Overview

overview

10

Static

static

10

b7fc6573a8...57.exe

windows7-x64

10

b7fc6573a8...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057

  • Size

    696KB

  • Sample

    220724-qyg8sseag7

  • MD5

    eea0bfc956030c707404fe5b4bc3e2bb

  • SHA1

    b4d48794d49a8624f580a1ba8a89dee415d2157f

  • SHA256

    b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057

  • SHA512

    4b6d9a79c8605b89c4073bd00c2ec7f46b63caf29c77c01a2f67f9847528e4d4af1163cddf356f74a2bf7f813cf990b745f4be4f5e7e0948e5e95b5e71a21b55

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057

    • Size

      696KB

    • MD5

      eea0bfc956030c707404fe5b4bc3e2bb

    • SHA1

      b4d48794d49a8624f580a1ba8a89dee415d2157f

    • SHA256

      b7fc6573a8b994291745ef6319829349137b44ee5bea54036acf1ca0b1776057

    • SHA512

      4b6d9a79c8605b89c4073bd00c2ec7f46b63caf29c77c01a2f67f9847528e4d4af1163cddf356f74a2bf7f813cf990b745f4be4f5e7e0948e5e95b5e71a21b55

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks