neshta | d5dd557441397860a043a5eceac088f2937f79f6927d26b84b77d7d9694321ec | Triage

Sharing

General

Target

d5dd557441397860a043a5eceac088f2937f79f6927d26b84b77d7d9694321ec
Size

40KB
Sample

221127-yvb7daef42
MD5

39c9bc101e2ceae55205aec2517b562d
SHA1

ac17b9d60ba4bb17c77c97903621c622163d61b7
SHA256

d5dd557441397860a043a5eceac088f2937f79f6927d26b84b77d7d9694321ec
SHA512

dec4c5fa94064af59881b086eaaa6e82074b10ed5b6cd1375a5389f54672dcdcb5da68d173e1711d7eb0edf569098f2f58d7146374169f648d0d8f4bce959aa0
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJxHD:JxqjQ+P04wsmJC

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  d5dd557441397860a043a5eceac088f2937f79f6927d26b84b77d7d9694321ec
- Size
  
  40KB
- MD5
  
  39c9bc101e2ceae55205aec2517b562d
- SHA1
  
  ac17b9d60ba4bb17c77c97903621c622163d61b7
- SHA256
  
  d5dd557441397860a043a5eceac088f2937f79f6927d26b84b77d7d9694321ec
- SHA512
  
  dec4c5fa94064af59881b086eaaa6e82074b10ed5b6cd1375a5389f54672dcdcb5da68d173e1711d7eb0edf569098f2f58d7146374169f648d0d8f4bce959aa0
- SSDEEP
  
  768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJxHD:JxqjQ+P04wsmJC
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer