neshta | 1fe573ec1d114e08ff7e07b1239dce08cd0691f40321219f08ed25c17ef45ffc | Triage

Sharing

General

Target

1fe573ec1d114e08ff7e07b1239dce08cd0691f40321219f08ed25c17ef45ffcN
Size

90KB
Sample

241010-lemlyssgrc
MD5

f5285468da2501a61ec9a6f0f2d96930
SHA1

837fbffd806cf4e37e598b9f816a35408d6ea30a
SHA256

1fe573ec1d114e08ff7e07b1239dce08cd0691f40321219f08ed25c17ef45ffc
SHA512

a5c9c0c74c67de73f6fc1c3311abd026a212a228cd234f5baf5b5b29bee7d4615bc4fb1602f57a970016b2632471df3e4a6dd8f8a33778dc15e369cb65b206f1
SSDEEP

1536:yxqjQ+P04wsZLnDrCv7xsLUXYmC2wMtjXxBfQlKVY8R:zr8WDrC9IUomzwMtlRQlKHR

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  1fe573ec1d114e08ff7e07b1239dce08cd0691f40321219f08ed25c17ef45ffcN
- Size
  
  90KB
- MD5
  
  f5285468da2501a61ec9a6f0f2d96930
- SHA1
  
  837fbffd806cf4e37e598b9f816a35408d6ea30a
- SHA256
  
  1fe573ec1d114e08ff7e07b1239dce08cd0691f40321219f08ed25c17ef45ffc
- SHA512
  
  a5c9c0c74c67de73f6fc1c3311abd026a212a228cd234f5baf5b5b29bee7d4615bc4fb1602f57a970016b2632471df3e4a6dd8f8a33778dc15e369cb65b206f1
- SSDEEP
  
  1536:yxqjQ+P04wsZLnDrCv7xsLUXYmC2wMtjXxBfQlKVY8R:zr8WDrC9IUomzwMtlRQlKHR
Score

10^/10

neshta discovery persistence spyware stealer
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespywarestealer

behavioral2

neshtadiscoverypersistencespywarestealer