neshta | b0d38263bbd880eccb704e0c34d6a96980a2b29b214b6e219e5921350194173a | Triage

Sharing

General

Target

b0d38263bbd880eccb704e0c34d6a96980a2b29b214b6e219e5921350194173a
Size

40KB
Sample

221119-ngdsyadb91
MD5

417b7efdf7ee6e64c9d9dc29c15a84a5
SHA1

7e10805698a2304f5061deff58d3cd2b590a5bf8
SHA256

b0d38263bbd880eccb704e0c34d6a96980a2b29b214b6e219e5921350194173a
SHA512

50d617b7817f409ada7f75a191a9b5137eb1fa5b985fd2661e2be2e6c9fe5f8293f62123a06b267ce052bda39dd70e84db5fc80bd566a4b54be95996f6fb0411
SSDEEP

768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJjKro:yxqjQ+P04wsZLnDrCcKk

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  b0d38263bbd880eccb704e0c34d6a96980a2b29b214b6e219e5921350194173a
- Size
  
  40KB
- MD5
  
  417b7efdf7ee6e64c9d9dc29c15a84a5
- SHA1
  
  7e10805698a2304f5061deff58d3cd2b590a5bf8
- SHA256
  
  b0d38263bbd880eccb704e0c34d6a96980a2b29b214b6e219e5921350194173a
- SHA512
  
  50d617b7817f409ada7f75a191a9b5137eb1fa5b985fd2661e2be2e6c9fe5f8293f62123a06b267ce052bda39dd70e84db5fc80bd566a4b54be95996f6fb0411
- SSDEEP
  
  768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJjKro:yxqjQ+P04wsZLnDrCcKk
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer