neshta | 9b6cbee928bc537466b782bca553226423a6c63e31d9b72e6ec5b6c6b27b3192 | Triage

Sharing

General

Target

9b6cbee928bc537466b782bca553226423a6c63e31d9b72e6ec5b6c6b27b3192
Size

40KB
Sample

221121-ngvfpaca3t
MD5

13d629f76356dc835270a853c576ad9f
SHA1

a8230fbb36e7d8d462c30afa83090693c6470cf7
SHA256

9b6cbee928bc537466b782bca553226423a6c63e31d9b72e6ec5b6c6b27b3192
SHA512

03cc24e5abd7a7f7d3812938eb18f7a3a36903216868e326a35679b7c389b86c048c482a0ef6833c4175c161c80aa55d651e2cd4ee46ed1a00e7945746887b27
SSDEEP

768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJPB:yxqjQ+P04wsZLnDrCm

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  9b6cbee928bc537466b782bca553226423a6c63e31d9b72e6ec5b6c6b27b3192
- Size
  
  40KB
- MD5
  
  13d629f76356dc835270a853c576ad9f
- SHA1
  
  a8230fbb36e7d8d462c30afa83090693c6470cf7
- SHA256
  
  9b6cbee928bc537466b782bca553226423a6c63e31d9b72e6ec5b6c6b27b3192
- SHA512
  
  03cc24e5abd7a7f7d3812938eb18f7a3a36903216868e326a35679b7c389b86c048c482a0ef6833c4175c161c80aa55d651e2cd4ee46ed1a00e7945746887b27
- SSDEEP
  
  768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJPB:yxqjQ+P04wsZLnDrCm
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer