neshta | 0985ba584e7ccf721576603a4f5d49cae1591521a69b96912227892d179eeeff | Triage

Sharing

General

Target

0985ba584e7ccf721576603a4f5d49cae1591521a69b96912227892d179eeeff
Size

40KB
Sample

221122-1lyp5aab35
MD5

ef54a1fc049cd8f65523ac566a7e20c2
SHA1

caeec350c130636bf5cb981fa734e406bfa79511
SHA256

0985ba584e7ccf721576603a4f5d49cae1591521a69b96912227892d179eeeff
SHA512

5a27333f2b611816508059017b279665aa1adb3945086a920c44e8aecf6fec2a6703064efa516414b5b7a9c598ce9ac1ac151dac50c663f8a1e0e98159d5b716
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJUEmF/:JxqjQ+P04wsmJCfEm

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  0985ba584e7ccf721576603a4f5d49cae1591521a69b96912227892d179eeeff
- Size
  
  40KB
- MD5
  
  ef54a1fc049cd8f65523ac566a7e20c2
- SHA1
  
  caeec350c130636bf5cb981fa734e406bfa79511
- SHA256
  
  0985ba584e7ccf721576603a4f5d49cae1591521a69b96912227892d179eeeff
- SHA512
  
  5a27333f2b611816508059017b279665aa1adb3945086a920c44e8aecf6fec2a6703064efa516414b5b7a9c598ce9ac1ac151dac50c663f8a1e0e98159d5b716
- SSDEEP
  
  768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJUEmF/:JxqjQ+P04wsmJCfEm
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer