neshta | b36ee72fbe2f53748b79053cb050d9049d80468359fb14bf87c975b41946a5a4 | Triage

Sharing

General

Target

b36ee72fbe2f53748b79053cb050d9049d80468359fb14bf87c975b41946a5a4.exe
Size

904KB
Sample

241124-sdmnws1mdr
MD5

9837c7f6aad4e89e4cda69686adb1fbd
SHA1

ebc8f12b4621f05fc5a9ed5d4bbb1988651b2aa7
SHA256

b36ee72fbe2f53748b79053cb050d9049d80468359fb14bf87c975b41946a5a4
SHA512

ee9feafae7f83b72c1a125d1f8df3a9fbd6aa541a8cba73d7669e2e7b8d9055387a09775ccc545318921e6cdd739875dc253d298c2f2d37905bd2624c6655f05
SSDEEP

12288:SN2M5DeK+U7X+nQOOOId4ZSuq777rg8MrEeWCt/II+jkrWW:42HJn6qE777rgltA3jkrWW

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  b36ee72fbe2f53748b79053cb050d9049d80468359fb14bf87c975b41946a5a4.exe
- Size
  
  904KB
- MD5
  
  9837c7f6aad4e89e4cda69686adb1fbd
- SHA1
  
  ebc8f12b4621f05fc5a9ed5d4bbb1988651b2aa7
- SHA256
  
  b36ee72fbe2f53748b79053cb050d9049d80468359fb14bf87c975b41946a5a4
- SHA512
  
  ee9feafae7f83b72c1a125d1f8df3a9fbd6aa541a8cba73d7669e2e7b8d9055387a09775ccc545318921e6cdd739875dc253d298c2f2d37905bd2624c6655f05
- SSDEEP
  
  12288:SN2M5DeK+U7X+nQOOOId4ZSuq777rg8MrEeWCt/II+jkrWW:42HJn6qE777rgltA3jkrWW
Score

10^/10

neshta discovery persistence spyware stealer
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespywarestealer

behavioral2

neshtadiscoverypersistencespywarestealer