neshta | 75d912ac660ddb8f15e97190ddab7daef0bb6f94c6ea815beb63cc9559fae7c9 | Triage

Submit
Reports

Overview

overview

Static

static

75d912ac66...9N.exe

windows7-x64

75d912ac66...9N.exe

windows10-2004-x64

Sharing

General

Target

75d912ac660ddb8f15e97190ddab7daef0bb6f94c6ea815beb63cc9559fae7c9N.exe
Size

231KB
Sample

241119-r6g4faxjgy
MD5

51bb165ad8ac54e480ca0199d6eab550
SHA1

a4f4eb548cb3a62b717a89d68c4002eaa4908ec3
SHA256

75d912ac660ddb8f15e97190ddab7daef0bb6f94c6ea815beb63cc9559fae7c9
SHA512

579d32e9bff0ca369215f3371fc0a408e2a5841eb7e8fc14646aa72ff2ebda295f72ffa78da4f2cdfb945a9c9af78524bfaef7783de263768e9743c49d77db0c
SSDEEP

3072:sr85CHMI8ROB/WD0vWFYeW8qURpqHzz/gZWnIVOAw085X6hFDZDWPFg1o/V7rFMw:k9HiK/2C+6s0IVOAw0XZWqGd7RMJol

Score

10^/10

neshta discovery persistence spyware stealer

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

75d912ac660ddb8f15e97190ddab7daef0bb6f94c6ea815beb63cc9559fae7c9N.exe

Resource

win7-20240903-en

neshta discovery persistence spyware stealer

windows7-x64

12 signatures

120 seconds

Behavioral task

behavioral2

Sample

75d912ac660ddb8f15e97190ddab7daef0bb6f94c6ea815beb63cc9559fae7c9N.exe

Resource

win10v2004-20241007-en

neshta discovery persistence spyware stealer

windows10-2004-x64

12 signatures

120 seconds

Malware Config

Targets

- Target
  
  75d912ac660ddb8f15e97190ddab7daef0bb6f94c6ea815beb63cc9559fae7c9N.exe
- Size
  
  231KB
- MD5
  
  51bb165ad8ac54e480ca0199d6eab550
- SHA1
  
  a4f4eb548cb3a62b717a89d68c4002eaa4908ec3
- SHA256
  
  75d912ac660ddb8f15e97190ddab7daef0bb6f94c6ea815beb63cc9559fae7c9
- SHA512
  
  579d32e9bff0ca369215f3371fc0a408e2a5841eb7e8fc14646aa72ff2ebda295f72ffa78da4f2cdfb945a9c9af78524bfaef7783de263768e9743c49d77db0c
- SSDEEP
  
  3072:sr85CHMI8ROB/WD0vWFYeW8qURpqHzz/gZWnIVOAw085X6hFDZDWPFg1o/V7rFMw:k9HiK/2C+6s0IVOAw0XZWqGd7RMJol
Score

10^/10

neshta discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespywarestealer

behavioral2

neshtadiscoverypersistencespywarestealer

© 2018-2024

Terms | Privacy