Overview

overview

10

Static

static

3

PO#RFQ-HL51L05....exe

windows10-2004-x64

10

PO#RFQ-HL51L05....exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO#RFQ-HL51L05....exe

  • Size

    858KB

  • Sample

    250415-rwx2xaztbs

  • MD5

    c98f8cb0f627f8d8859acf950b145eab

  • SHA1

    81ffcdc2addbaa505722edd91468c5a561dee781

  • SHA256

    4d934eff240fdf3c222505a546d8fb8c682a3affb70e4a85c635f607a47d8b1a

  • SHA512

    cb01aa4a16bf9c0b682bf7b9e00678cb47ecacf24ffedcfea68cea652584f21e711fa3c7578b09b51eca6eadf962bf25e1457a54d0d3f101f2e4d9681ff0a4aa

  • SSDEEP

    24576:kXOlaVwfNQnzFy1frX0EhHdG+V4ZQB8Gv:kDzo5oEpdGqSQBJ

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      PO#RFQ-HL51L05....exe

    • Size

      858KB

    • MD5

      c98f8cb0f627f8d8859acf950b145eab

    • SHA1

      81ffcdc2addbaa505722edd91468c5a561dee781

    • SHA256

      4d934eff240fdf3c222505a546d8fb8c682a3affb70e4a85c635f607a47d8b1a

    • SHA512

      cb01aa4a16bf9c0b682bf7b9e00678cb47ecacf24ffedcfea68cea652584f21e711fa3c7578b09b51eca6eadf962bf25e1457a54d0d3f101f2e4d9681ff0a4aa

    • SSDEEP

      24576:kXOlaVwfNQnzFy1frX0EhHdG+V4ZQB8Gv:kDzo5oEpdGqSQBJ

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks