neshta | 2c79ef043b318ccab19d778d268335609b0a1a608612f6ba2752b095e6a63d7d | Triage

Sharing

General

Target

2c79ef043b318ccab19d778d268335609b0a1a608612f6ba2752b095e6a63d7d
Size

40KB
Sample

221121-nhyvhaca7s
MD5

10836e0c07a2033d254f9812e2874a96
SHA1

8dc4e10b751afecf8fad3e32b610929e2f07e733
SHA256

2c79ef043b318ccab19d778d268335609b0a1a608612f6ba2752b095e6a63d7d
SHA512

2b393719451988d6090ccb8bb2608725d1d2bce82f1717e03cc4c5a5c62f9c297182187b610722582ecdc327084f2e7ed545f361bd7637ce12175639e61cfddf
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJGgbhQ:JxqjQ+P04wsmJCmb

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  2c79ef043b318ccab19d778d268335609b0a1a608612f6ba2752b095e6a63d7d
- Size
  
  40KB
- MD5
  
  10836e0c07a2033d254f9812e2874a96
- SHA1
  
  8dc4e10b751afecf8fad3e32b610929e2f07e733
- SHA256
  
  2c79ef043b318ccab19d778d268335609b0a1a608612f6ba2752b095e6a63d7d
- SHA512
  
  2b393719451988d6090ccb8bb2608725d1d2bce82f1717e03cc4c5a5c62f9c297182187b610722582ecdc327084f2e7ed545f361bd7637ce12175639e61cfddf
- SSDEEP
  
  768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJGgbhQ:JxqjQ+P04wsmJCmb
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer