neshta | 76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9 | Triage

Sharing

General

Target

76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9
Size

40KB
Sample

221129-jynl9aah84
MD5

50e1b5d9a261def5f3596ebc127541c3
SHA1

66ca98d6319c5d97a942b4429f23032d468cd49e
SHA256

76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9
SHA512

ad17469950f2aacd8db30e905e49c997daee7a757293bbc05d0a65f4e54eab4c9e6f51843ebec4b927cbd3e5ce1dcd13a12a2f39843ba42934891995dc8f055c
SSDEEP

768:myxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJX8:RxqjQ+P04wsmJCg8

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9
- Size
  
  40KB
- MD5
  
  50e1b5d9a261def5f3596ebc127541c3
- SHA1
  
  66ca98d6319c5d97a942b4429f23032d468cd49e
- SHA256
  
  76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9
- SHA512
  
  ad17469950f2aacd8db30e905e49c997daee7a757293bbc05d0a65f4e54eab4c9e6f51843ebec4b927cbd3e5ce1dcd13a12a2f39843ba42934891995dc8f055c
- SSDEEP
  
  768:myxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJX8:RxqjQ+P04wsmJCg8
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespyware