neshta | 03aae0bc2301b52007028579ac325a2f19ac6200a4c791a72c036a1128cbd375 | Triage

Sharing

General

Target

03aae0bc2301b52007028579ac325a2f19ac6200a4c791a72c036a1128cbd375
Size

40KB
Sample

221106-1hdwjsehdm
MD5

0e03b84c01f6c970c915e86c4526a575
SHA1

21dad4918090cdc44b31a86e52ef8cbad227b740
SHA256

03aae0bc2301b52007028579ac325a2f19ac6200a4c791a72c036a1128cbd375
SHA512

51b44a7c0c37bf549a843e40e5c613673b6186dfa1c52a9e1fb8a6611e59552ca48d5e3f824ad3516df37429cc6862247cbedbe62d6ab15c93e042d1df2dbebc
SSDEEP

768:FyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJM:kxqjQ+P04wsZLnDrC

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  03aae0bc2301b52007028579ac325a2f19ac6200a4c791a72c036a1128cbd375
- Size
  
  40KB
- MD5
  
  0e03b84c01f6c970c915e86c4526a575
- SHA1
  
  21dad4918090cdc44b31a86e52ef8cbad227b740
- SHA256
  
  03aae0bc2301b52007028579ac325a2f19ac6200a4c791a72c036a1128cbd375
- SHA512
  
  51b44a7c0c37bf549a843e40e5c613673b6186dfa1c52a9e1fb8a6611e59552ca48d5e3f824ad3516df37429cc6862247cbedbe62d6ab15c93e042d1df2dbebc
- SSDEEP
  
  768:FyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJM:kxqjQ+P04wsZLnDrC
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer