Overview

overview

10

Static

static

5e3385a20d...a5.exe

windows7-x64

10

5e3385a20d...a5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e3385a20d41acedb5a3b93b5a8c76a5

  • Size

    620KB

  • Sample

    220726-2ek15aehdk

  • MD5

    5e3385a20d41acedb5a3b93b5a8c76a5

  • SHA1

    c63b1e59b8c08887d0de48ba5149b165091d00f7

  • SHA256

    bb671dbc4bb59548908a3bb9b9bb67c07e059ae50b2d347d04e7786a2e4527e5

  • SHA512

    74abad81d3c5fa2aa3982b99f2cb9bdd1d8b4010bbcc0878f1901069f8872d9d95a10d629651e06a14ced382a81f570f5bdae692bf7467d36a22a39781159abb

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      5e3385a20d41acedb5a3b93b5a8c76a5

    • Size

      620KB

    • MD5

      5e3385a20d41acedb5a3b93b5a8c76a5

    • SHA1

      c63b1e59b8c08887d0de48ba5149b165091d00f7

    • SHA256

      bb671dbc4bb59548908a3bb9b9bb67c07e059ae50b2d347d04e7786a2e4527e5

    • SHA512

      74abad81d3c5fa2aa3982b99f2cb9bdd1d8b4010bbcc0878f1901069f8872d9d95a10d629651e06a14ced382a81f570f5bdae692bf7467d36a22a39781159abb

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks