Overview

overview

10

Static

static

10

acrobroker.exe

windows7-x64

10

acrobroker.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acrobroker.exe

  • Size

    301KB

  • Sample

    250123-sdxh4atkaw

  • MD5

    8e689215b7800fc566c1843d5231641f

  • SHA1

    0484e4fc2085bd1e4a04eca4880ffb3f17800b92

  • SHA256

    6fe40e509f4e44963392c301a081300db4c7915e3d5746643c0541dc76bccc27

  • SHA512

    748d0efb079f23e98b5b88125de0eaec2554630a231b25ad4a19abfcd70f26055481a59b2feb586a471e8b44c1b97b1ccb0ad1bdbd668979fb5b04997067e1d6

  • SSDEEP

    6144:k9dyr8oe0K+rMQAt63mby+LCtmVxYNG/uMrqrX+pb:oy34gWd+QYNK7qrX+Z

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      acrobroker.exe

    • Size

      301KB

    • MD5

      8e689215b7800fc566c1843d5231641f

    • SHA1

      0484e4fc2085bd1e4a04eca4880ffb3f17800b92

    • SHA256

      6fe40e509f4e44963392c301a081300db4c7915e3d5746643c0541dc76bccc27

    • SHA512

      748d0efb079f23e98b5b88125de0eaec2554630a231b25ad4a19abfcd70f26055481a59b2feb586a471e8b44c1b97b1ccb0ad1bdbd668979fb5b04997067e1d6

    • SSDEEP

      6144:k9dyr8oe0K+rMQAt63mby+LCtmVxYNG/uMrqrX+pb:oy34gWd+QYNK7qrX+Z

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks