Overview

overview

10

Static

static

10

688863712b...71.exe

windows7-x64

10

688863712b...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    688863712b98d9793b3ee81c11180171

  • Size

    256KB

  • Sample

    220811-xsg46sddf3

  • MD5

    688863712b98d9793b3ee81c11180171

  • SHA1

    7ee969c9eb51e4e2c3632ad2492808af329c2ba7

  • SHA256

    042e433a0b093c965906258b2fa96715ff377376ce10b3acb74a4f25f02a8c57

  • SHA512

    b4e5c2fb96a245337e0a6d7b06ad223a40882f5cc7c96350eea23c2af22cd420fbb912949246ec6bbf47ad20d2a2ec2f1856a5fb99be3051fcf25ddde35d92cd

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      688863712b98d9793b3ee81c11180171

    • Size

      256KB

    • MD5

      688863712b98d9793b3ee81c11180171

    • SHA1

      7ee969c9eb51e4e2c3632ad2492808af329c2ba7

    • SHA256

      042e433a0b093c965906258b2fa96715ff377376ce10b3acb74a4f25f02a8c57

    • SHA512

      b4e5c2fb96a245337e0a6d7b06ad223a40882f5cc7c96350eea23c2af22cd420fbb912949246ec6bbf47ad20d2a2ec2f1856a5fb99be3051fcf25ddde35d92cd

    Score
    10/10
    neshtapersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks