neshta | 1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90 | Triage

Sharing

General

Target

1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90
Size

40KB
Sample

221119-ngwnradc3t
MD5

33b964e0ef93c35f70c3535886f9086a
SHA1

b4ff61096a939523791e91e662e21da6fa9119c2
SHA256

1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90
SHA512

bee83e1ab27ee2292791f3f24cf4fd3cbe83f97cf329f07d9548c4972b44da7a6774308dd352c9f572dbdb1c627c6a7f40132359eb2ad9d94d8e9ea86631f429
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJfMENK:JxqjQ+P04wsmJC

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90
- Size
  
  40KB
- MD5
  
  33b964e0ef93c35f70c3535886f9086a
- SHA1
  
  b4ff61096a939523791e91e662e21da6fa9119c2
- SHA256
  
  1b1621bd9ea44afd4c0ebd746cf408013bb240972dcee6f615f2df5f6b2fdc90
- SHA512
  
  bee83e1ab27ee2292791f3f24cf4fd3cbe83f97cf329f07d9548c4972b44da7a6774308dd352c9f572dbdb1c627c6a7f40132359eb2ad9d94d8e9ea86631f429
- SSDEEP
  
  768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJfMENK:JxqjQ+P04wsmJC
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer