neshta | 98c376e5e780af1d72ebfe499b4df963fb74cf75072a13cf19cb8ab72efa539d | Triage

Sharing

General

Target

98c376e5e780af1d72ebfe499b4df963fb74cf75072a13cf19cb8ab72efa539d
Size

40KB
Sample

221202-r2e4aabf5t
MD5

fd483510115d0ac635f7ada57a09a2b8
SHA1

344a7d592c6f739bfb0ec59dc2335d844896a088
SHA256

98c376e5e780af1d72ebfe499b4df963fb74cf75072a13cf19cb8ab72efa539d
SHA512

ebc0eee134bc0114d5aad78e5ede429dad78be924ba0f6947390d7c699bfebb5fc3bdc6f18eecbcb0fd698e88f4a722c69a0451ca8fb7a7c76db9919f5c23475
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJj+7:JxqjQ+P04wsmJC

Score

10^/10

neshta persistence spyware stealer

Malware Config

Targets

- Target
  
  98c376e5e780af1d72ebfe499b4df963fb74cf75072a13cf19cb8ab72efa539d
- Size
  
  40KB
- MD5
  
  fd483510115d0ac635f7ada57a09a2b8
- SHA1
  
  344a7d592c6f739bfb0ec59dc2335d844896a088
- SHA256
  
  98c376e5e780af1d72ebfe499b4df963fb74cf75072a13cf19cb8ab72efa539d
- SHA512
  
  ebc0eee134bc0114d5aad78e5ede429dad78be924ba0f6947390d7c699bfebb5fc3bdc6f18eecbcb0fd698e88f4a722c69a0451ca8fb7a7c76db9919f5c23475
- SSDEEP
  
  768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJj+7:JxqjQ+P04wsmJC
Score

10^/10

neshta persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

neshtapersistencespywarestealer

behavioral2

neshtapersistencespywarestealer