Overview

overview

10

Static

static

0893f96ed6...49.exe

windows7-x64

10

0893f96ed6...49.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0893f96ed6831c745ebc3d19d9f96749

  • Size

    18KB

  • Sample

    220729-1fpj9sdcb5

  • MD5

    0893f96ed6831c745ebc3d19d9f96749

  • SHA1

    5b33dfac19433268f3c8964aecd6cdc83569cfa6

  • SHA256

    ca4a862e957347dc3501e55fcf6ab8d130f141afea00c22f3bf25bf938531a35

  • SHA512

    0a2e3b791c24f741ce34f52c375f91a7d1bc4139e56fe9f6a08bef11c6cc4aeb510fa50c4605e5b79d19d1460fb87994d6fd9d6fe5d82031d4c6520154144d28

Score
10/10
neshtapersistencespyware

Malware Config

Targets

    • Target

      0893f96ed6831c745ebc3d19d9f96749

    • Size

      18KB

    • MD5

      0893f96ed6831c745ebc3d19d9f96749

    • SHA1

      5b33dfac19433268f3c8964aecd6cdc83569cfa6

    • SHA256

      ca4a862e957347dc3501e55fcf6ab8d130f141afea00c22f3bf25bf938531a35

    • SHA512

      0a2e3b791c24f741ce34f52c375f91a7d1bc4139e56fe9f6a08bef11c6cc4aeb510fa50c4605e5b79d19d1460fb87994d6fd9d6fe5d82031d4c6520154144d28

    Score
    10/10
    neshtapersistencespyware

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks