neshta | a85a9393ef1ffaab662fdb4adfba5d2f4006e044ddb8ee5e59ca30b193cbecfd | Triage

Sharing

General

Target

a85a9393ef1ffaab662fdb4adfba5d2f4006e044ddb8ee5e59ca30b193cbecfd
Size

40KB
Sample

221202-r2dv8aga52
MD5

5bc6de5808f628ddec5315348b3e1b48
SHA1

9844a4644d6d91dae890c3d6879a36733b974802
SHA256

a85a9393ef1ffaab662fdb4adfba5d2f4006e044ddb8ee5e59ca30b193cbecfd
SHA512

93c69f66efd134026b65ea85294ef9a3bdc592cff24f3251f544c10ec15123b60e00fa7d87915631e55738894297571d347a5cfbf1dc9aede442a5771ab84bb7
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJSRR:JxqjQ+P04wsmJClR

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  a85a9393ef1ffaab662fdb4adfba5d2f4006e044ddb8ee5e59ca30b193cbecfd
- Size
  
  40KB
- MD5
  
  5bc6de5808f628ddec5315348b3e1b48
- SHA1
  
  9844a4644d6d91dae890c3d6879a36733b974802
- SHA256
  
  a85a9393ef1ffaab662fdb4adfba5d2f4006e044ddb8ee5e59ca30b193cbecfd
- SHA512
  
  93c69f66efd134026b65ea85294ef9a3bdc592cff24f3251f544c10ec15123b60e00fa7d87915631e55738894297571d347a5cfbf1dc9aede442a5771ab84bb7
- SSDEEP
  
  768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJSRR:JxqjQ+P04wsmJClR
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer