neshta | cead92142cd20ccecd2dce2a514fa8f860b1493369cf8458e3698ee9f8cd8938 | Triage

Sharing

General

Target

cead92142cd20ccecd2dce2a514fa8f860b1493369cf8458e3698ee9f8cd8938
Size

40KB
Sample

221121-ngp6zagc97
MD5

29f7338eaaabb158065971e82dcc8efc
SHA1

944b23a3a677ebe98c18ffcd346dc27ecfb8a102
SHA256

cead92142cd20ccecd2dce2a514fa8f860b1493369cf8458e3698ee9f8cd8938
SHA512

c7408f2302d2e6178e31c8c594cc4e1cd29cb087e9b3f675f1fc7444a31d5c756ba5676d93f6abf1683e44a984373360c3e88a98641f0dadbba208ffbea66c86
SSDEEP

768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJ2Qgj:yxqjQ+P04wsZLnDrCoG

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  cead92142cd20ccecd2dce2a514fa8f860b1493369cf8458e3698ee9f8cd8938
- Size
  
  40KB
- MD5
  
  29f7338eaaabb158065971e82dcc8efc
- SHA1
  
  944b23a3a677ebe98c18ffcd346dc27ecfb8a102
- SHA256
  
  cead92142cd20ccecd2dce2a514fa8f860b1493369cf8458e3698ee9f8cd8938
- SHA512
  
  c7408f2302d2e6178e31c8c594cc4e1cd29cb087e9b3f675f1fc7444a31d5c756ba5676d93f6abf1683e44a984373360c3e88a98641f0dadbba208ffbea66c86
- SSDEEP
  
  768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJ2Qgj:yxqjQ+P04wsZLnDrCoG
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer