neshta | 63fff06bbeec1534bde287f0c36b74c95b7b02107f232b0d5da54956337882d6 | Triage

Submit
Reports

Overview

overview

Static

static

63fff06bbe...d6.exe

windows7-x64

63fff06bbe...d6.exe

windows10-2004-x64

Sharing

General

Target

63fff06bbeec1534bde287f0c36b74c95b7b02107f232b0d5da54956337882d6
Size

1.7MB
Sample

241115-2qch5atglb
MD5

8a76c301d89fd6ec3e30eb42d6375f11
SHA1

054b919a939ad6fe3457775ef6ed4fed7651c024
SHA256

63fff06bbeec1534bde287f0c36b74c95b7b02107f232b0d5da54956337882d6
SHA512

cbefded92cd514bed35d53878d442e0cc7ba972780aaece6da2fe3ceb7bc05929a64af1f6e2b2aa163341b562a99c53bcf681ebb2d92dfea4fc2c9c21fb6492c
SSDEEP

24576:GWgGY00E/5Hez3CcHODrtU6kHzjSs943soq9/J99almypzS9Syj/:IGYM5HezSUd9BPUzi

Score

10^/10

neshta discovery persistence spyware stealer

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

63fff06bbeec1534bde287f0c36b74c95b7b02107f232b0d5da54956337882d6.exe

Resource

win7-20241023-en

neshta discovery persistence spyware stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

63fff06bbeec1534bde287f0c36b74c95b7b02107f232b0d5da54956337882d6.exe

Resource

win10v2004-20241007-en

neshta discovery persistence spyware stealer

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  63fff06bbeec1534bde287f0c36b74c95b7b02107f232b0d5da54956337882d6
- Size
  
  1.7MB
- MD5
  
  8a76c301d89fd6ec3e30eb42d6375f11
- SHA1
  
  054b919a939ad6fe3457775ef6ed4fed7651c024
- SHA256
  
  63fff06bbeec1534bde287f0c36b74c95b7b02107f232b0d5da54956337882d6
- SHA512
  
  cbefded92cd514bed35d53878d442e0cc7ba972780aaece6da2fe3ceb7bc05929a64af1f6e2b2aa163341b562a99c53bcf681ebb2d92dfea4fc2c9c21fb6492c
- SSDEEP
  
  24576:GWgGY00E/5Hez3CcHODrtU6kHzjSs943soq9/J99almypzS9Syj/:IGYM5HezSUd9BPUzi
Score

10^/10

neshta discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespywarestealer

behavioral2

neshtadiscoverypersistencespywarestealer

© 2018-2024

Terms | Privacy