Overview

overview

10

Static

static

10

5845a4062c...40.exe

windows7-x64

10

5845a4062c...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5845a4062cfefc54f41164c7cd2915a8e04146c7f87f432400c80ec8bc50b640

  • Size

    732KB

  • Sample

    220724-tb5blahgcn

  • MD5

    ef8aaf198f10369fb083634bd538c63b

  • SHA1

    6d20cf0f6541c4a80a82241accdbc496777009f3

  • SHA256

    5845a4062cfefc54f41164c7cd2915a8e04146c7f87f432400c80ec8bc50b640

  • SHA512

    4caeed1e7dd0e03a68d319f2dcfb8bc1ce47b6d46606a6eca35134ecc0c5a8bddb9501bd4ccec91000d8ee53159804c9d34ab2f7e9d91b43a25406b7d1dc6f0d

Score
10/10
neshtaponypersistencespywarestealer

Malware Config

Extracted

Family

pony

C2

http://insightthk.com/pop8dot/gphs/gate.php

Attributes
  • payload_url

    http://myp0nysite.ru/shit.exe

Targets

    • Target

      5845a4062cfefc54f41164c7cd2915a8e04146c7f87f432400c80ec8bc50b640

    • Size

      732KB

    • MD5

      ef8aaf198f10369fb083634bd538c63b

    • SHA1

      6d20cf0f6541c4a80a82241accdbc496777009f3

    • SHA256

      5845a4062cfefc54f41164c7cd2915a8e04146c7f87f432400c80ec8bc50b640

    • SHA512

      4caeed1e7dd0e03a68d319f2dcfb8bc1ce47b6d46606a6eca35134ecc0c5a8bddb9501bd4ccec91000d8ee53159804c9d34ab2f7e9d91b43a25406b7d1dc6f0d

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks