neshta | eb73ba665465e57084e4c5dfd9ce52e5485019fad6fb14938f70d4d082cdff29 | Triage

Submit
Reports

Overview

overview

Static

static

eb73ba6654...29.exe

windows7-x64

eb73ba6654...29.exe

windows10-2004-x64

Sharing

General

Target

eb73ba665465e57084e4c5dfd9ce52e5485019fad6fb14938f70d4d082cdff29
Size

600KB
Sample

241103-gn38vaxane
MD5

28b92a132aa24d08a62aebaa02197bf8
SHA1

193da5ccbb4ea68c4554b5f596093b883614bb9d
SHA256

eb73ba665465e57084e4c5dfd9ce52e5485019fad6fb14938f70d4d082cdff29
SHA512

817d1ab5401c83b7aa7501b9bd493c4a488929aa7d1575bddfe37baa9bdd94d80c7857ebab9c843a07e160eb1edccd77dbe8fe77a30cc7a7bb805b654f5c6fc4
SSDEEP

12288:4WiGrFOqwYHDTNFiLFXZykLJlMtgj6oA7:CEw8XPeuuG

Score

10^/10

neshta discovery persistence spyware stealer

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

eb73ba665465e57084e4c5dfd9ce52e5485019fad6fb14938f70d4d082cdff29.exe

Resource

win7-20240903-en

neshta discovery persistence spyware stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

eb73ba665465e57084e4c5dfd9ce52e5485019fad6fb14938f70d4d082cdff29.exe

Resource

win10v2004-20241007-en

neshta discovery persistence spyware stealer

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  eb73ba665465e57084e4c5dfd9ce52e5485019fad6fb14938f70d4d082cdff29
- Size
  
  600KB
- MD5
  
  28b92a132aa24d08a62aebaa02197bf8
- SHA1
  
  193da5ccbb4ea68c4554b5f596093b883614bb9d
- SHA256
  
  eb73ba665465e57084e4c5dfd9ce52e5485019fad6fb14938f70d4d082cdff29
- SHA512
  
  817d1ab5401c83b7aa7501b9bd493c4a488929aa7d1575bddfe37baa9bdd94d80c7857ebab9c843a07e160eb1edccd77dbe8fe77a30cc7a7bb805b654f5c6fc4
- SSDEEP
  
  12288:4WiGrFOqwYHDTNFiLFXZykLJlMtgj6oA7:CEw8XPeuuG
Score

10^/10

neshta discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespywarestealer

behavioral2

neshtadiscoverypersistencespywarestealer

© 2018-2024

Terms | Privacy