Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    tmp

  • Size

    3.9MB

  • Sample

    231113-xgw4ysee4x

  • MD5

    0849bbd6489e2c9e29cda02169f243cd

  • SHA1

    4759c20035d8c6df35679910d65c9ad79c6da521

  • SHA256

    7ff63ced9ab495d072ba976462fcbf74e6529cdc9810a991e1f0b85d7c44b66e

  • SHA512

    6d97e24c012204a02a77b7ce7007fca68f3521f10389fe7589cb920d436c94a6786887e187d09637f738c36e244f3489fb960c33b62ccecf212209bfd9572581

  • SSDEEP

    98304:x+GA7R+afsMveTDN6US+8B4JZZACYrsaaRT:oGANzmTDN6UOBIZACYrsb

Score
10/10
neshtaxmrigminerpersistencespywarestealer

Malware Config

Targets

    • Target

      tmp

    • Size

      3.9MB

    • MD5

      0849bbd6489e2c9e29cda02169f243cd

    • SHA1

      4759c20035d8c6df35679910d65c9ad79c6da521

    • SHA256

      7ff63ced9ab495d072ba976462fcbf74e6529cdc9810a991e1f0b85d7c44b66e

    • SHA512

      6d97e24c012204a02a77b7ce7007fca68f3521f10389fe7589cb920d436c94a6786887e187d09637f738c36e244f3489fb960c33b62ccecf212209bfd9572581

    • SSDEEP

      98304:x+GA7R+afsMveTDN6US+8B4JZZACYrsaaRT:oGANzmTDN6UOBIZACYrsb

    Score
    10/10
    neshtaxmrigminerpersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks