neshta | 6529add83318647944e37d6c3dcc9b37e95f17574b84e9d939902353066e7030 | Triage

Sharing

General

Target

6529add83318647944e37d6c3dcc9b37e95f17574b84e9d939902353066e7030
Size

40KB
Sample

221002-yyfc7sadfq
MD5

6cc918028f23b9ef10854f720482afe0
SHA1

2e2aa77585f618a0be8d330354dcc8fbd7ac083a
SHA256

6529add83318647944e37d6c3dcc9b37e95f17574b84e9d939902353066e7030
SHA512

a4224009c4a6897e113433650355cd12eaaaa865c0170c3918824f029ac77c1c004f827506db313a6048b32f9e8e9a451be687b737506415746d73f72934d258
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJwXHxQF:JxqjQ+P04wsmJC5xQF

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  6529add83318647944e37d6c3dcc9b37e95f17574b84e9d939902353066e7030
- Size
  
  40KB
- MD5
  
  6cc918028f23b9ef10854f720482afe0
- SHA1
  
  2e2aa77585f618a0be8d330354dcc8fbd7ac083a
- SHA256
  
  6529add83318647944e37d6c3dcc9b37e95f17574b84e9d939902353066e7030
- SHA512
  
  a4224009c4a6897e113433650355cd12eaaaa865c0170c3918824f029ac77c1c004f827506db313a6048b32f9e8e9a451be687b737506415746d73f72934d258
- SSDEEP
  
  768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJwXHxQF:JxqjQ+P04wsmJC5xQF
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer