neshta | 5719388295cc904275d72c044e23e0e42b985dbe22187283960a1c066d6dba3a | Triage

Sharing

General

Target

5719388295cc904275d72c044e23e0e42b985dbe22187283960a1c066d6dba3a
Size

40KB
Sample

221123-xfq7baeh49
MD5

43d1fb2a124cc4606576006895a984c2
SHA1

e5d7164cf1e24f91534608dc4cb18afbfda422b6
SHA256

5719388295cc904275d72c044e23e0e42b985dbe22187283960a1c066d6dba3a
SHA512

57762d1e40b19ad13b06550618c822857009f0a03d28f6a01fc7f8749175e3c0c97100d566b9f7108af16ad6fb3153da7269d96f201f49461864554c4386b2f7
SSDEEP

768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJGd:yxqjQ+P04wsZLnDrC

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  5719388295cc904275d72c044e23e0e42b985dbe22187283960a1c066d6dba3a
- Size
  
  40KB
- MD5
  
  43d1fb2a124cc4606576006895a984c2
- SHA1
  
  e5d7164cf1e24f91534608dc4cb18afbfda422b6
- SHA256
  
  5719388295cc904275d72c044e23e0e42b985dbe22187283960a1c066d6dba3a
- SHA512
  
  57762d1e40b19ad13b06550618c822857009f0a03d28f6a01fc7f8749175e3c0c97100d566b9f7108af16ad6fb3153da7269d96f201f49461864554c4386b2f7
- SSDEEP
  
  768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJGd:yxqjQ+P04wsZLnDrC
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer