neshta | 044f7e40684d30532755fb646635d05696983eaf78912aeacc04d4b853d46485 | Triage

Sharing

General

Target

044f7e40684d30532755fb646635d05696983eaf78912aeacc04d4b853d46485
Size

40KB
Sample

221121-nh348aca7v
MD5

114ff5fe264f2157694f01a12adbb61d
SHA1

78a367680d9b69349b4029c3582b4b7cde3fc387
SHA256

044f7e40684d30532755fb646635d05696983eaf78912aeacc04d4b853d46485
SHA512

af207ced36b08c1cdaab97f98ccf078585838ae0e4f9c08762a80313f0bd056f840ad79d11aef0440218ba0561f77a4e1b9c86caed28bf33f253b88c137a97e0
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ2ENc5:JxqjQ+P04wsmJCS2

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  044f7e40684d30532755fb646635d05696983eaf78912aeacc04d4b853d46485
- Size
  
  40KB
- MD5
  
  114ff5fe264f2157694f01a12adbb61d
- SHA1
  
  78a367680d9b69349b4029c3582b4b7cde3fc387
- SHA256
  
  044f7e40684d30532755fb646635d05696983eaf78912aeacc04d4b853d46485
- SHA512
  
  af207ced36b08c1cdaab97f98ccf078585838ae0e4f9c08762a80313f0bd056f840ad79d11aef0440218ba0561f77a4e1b9c86caed28bf33f253b88c137a97e0
- SSDEEP
  
  768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ2ENc5:JxqjQ+P04wsmJCS2
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer