neshta | e4aa02c687a4fb8e5d36ca9c1213f245a8f0f48eb0fae47dfde309be85d98b23 | Triage

Submit
Reports

Overview

overview

Static

static

e4aa02c687...23.exe

windows7-x64

e4aa02c687...23.exe

windows10-2004-x64

Sharing

General

Target

e4aa02c687a4fb8e5d36ca9c1213f245a8f0f48eb0fae47dfde309be85d98b23
Size

1.5MB
Sample

241130-fmapgatmaw
MD5

346cfdadee25b3ec8ab0a59c98766224
SHA1

201c0e8cd4471c375cfe74234af13f647ec58bd5
SHA256

e4aa02c687a4fb8e5d36ca9c1213f245a8f0f48eb0fae47dfde309be85d98b23
SHA512

3f334c99ab4dc9b7a24a6484546353c1353943dfac263645bf22775f3a684d1246a066d9ba1ff03990ff0d8e5255dc1361db1ead95b0e8a0427f27e997c728e7
SSDEEP

24576:RT2Rz2tgM7U/+uXXTLymZRZlqyUZH5PZq5HUbtJDopCmezxrrfkwWsX8MYRb1iSG:RSnM/NZq5HUbMpCTzxPfk8X8MYRb1iSG

Score

10^/10

neshta discovery persistence spyware stealer

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

e4aa02c687a4fb8e5d36ca9c1213f245a8f0f48eb0fae47dfde309be85d98b23.exe

Resource

win7-20240903-en

neshta discovery persistence spyware stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

e4aa02c687a4fb8e5d36ca9c1213f245a8f0f48eb0fae47dfde309be85d98b23.exe

Resource

win10v2004-20241007-en

neshta discovery persistence spyware stealer

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  e4aa02c687a4fb8e5d36ca9c1213f245a8f0f48eb0fae47dfde309be85d98b23
- Size
  
  1.5MB
- MD5
  
  346cfdadee25b3ec8ab0a59c98766224
- SHA1
  
  201c0e8cd4471c375cfe74234af13f647ec58bd5
- SHA256
  
  e4aa02c687a4fb8e5d36ca9c1213f245a8f0f48eb0fae47dfde309be85d98b23
- SHA512
  
  3f334c99ab4dc9b7a24a6484546353c1353943dfac263645bf22775f3a684d1246a066d9ba1ff03990ff0d8e5255dc1361db1ead95b0e8a0427f27e997c728e7
- SSDEEP
  
  24576:RT2Rz2tgM7U/+uXXTLymZRZlqyUZH5PZq5HUbtJDopCmezxrrfkwWsX8MYRb1iSG:RSnM/NZq5HUbMpCTzxPfk8X8MYRb1iSG
Score

10^/10

neshta discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespywarestealer

behavioral2

neshtadiscoverypersistencespywarestealer

© 2018-2024

Terms | Privacy