neshta

General

Target

New folder.zip
Size

2.5MB
Sample

241208-m4qwca1phv
MD5

65780cd3831917d347ea14a8d21c61cb
SHA1

3fc3ec41b47b894859f955ee4d61214aeb282cce
SHA256

63a3e3646193f7dfb4230949c5166b42df0e469996d3028783f3920f867e0c2c
SHA512

f3bfbbf8ed9b9ab59dda5f064ef9cd885a13dbff299ea22f81c7e42015fe2404e83eccc5bfada71523107e1acc693fbb49edbdc25076711ce07eca79ae823680
SSDEEP

49152:F/Jev9V1ZFPsXkERNkamWmLxm6HwurcU4pEyfagxbybJeQdthmLcpoYK8e7GB77b:PiZFePNkjW0xdwC3K7Co2JltRGF8dVV5

Score

10^/10

Malware Config

Targets

- Target
  
  New folder.zip
- Size
  
  2.5MB
- MD5
  
  65780cd3831917d347ea14a8d21c61cb
- SHA1
  
  3fc3ec41b47b894859f955ee4d61214aeb282cce
- SHA256
  
  63a3e3646193f7dfb4230949c5166b42df0e469996d3028783f3920f867e0c2c
- SHA512
  
  f3bfbbf8ed9b9ab59dda5f064ef9cd885a13dbff299ea22f81c7e42015fe2404e83eccc5bfada71523107e1acc693fbb49edbdc25076711ce07eca79ae823680
- SSDEEP
  
  49152:F/Jev9V1ZFPsXkERNkamWmLxm6HwurcU4pEyfagxbybJeQdthmLcpoYK8e7GB77b:PiZFePNkjW0xdwC3K7Co2JltRGF8dVV5
Score

10^/10

neshta discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  New folder/Keygen.exe
- Size
  
  2.5MB
- MD5
  
  e72838eccda2eae29e96b0c572d783c3
- SHA1
  
  60f0944ecbd21cf590445c12ba89a2ae48f27a6a
- SHA256
  
  f824fdc666630ccb179d9086b79783e3ede76e4392a5edfdd20d93b7259ae061
- SHA512
  
  7439902a4f16d29dcc4c749adc40f4541d509e607d915287c6c98f609ef14c4eb99ec507d7e7c853527a6c08628a367b21ae0f066828c2cc8792f2c1a3fa77f8
- SSDEEP
  
  49152:IJdf39XFINkWr5kkYe6TdOYz44rcaMJIsjOO/ry3X0EdNZgJAxGEG8CZaFDG5UN:q9XaH5kheKdX4cjuR6q6XTNTI58ZTN
Score

10^/10

neshta discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  
  New folder/New Text Document.txt
- Size
  
  40B
- MD5
  
  75ca34e5d1bcd6caec8a48ba75cf015b
- SHA1
  
  6d340c19d1827268d062b7759e4d6aef45d4b871
- SHA256
  
  0ef058ee54bdbf2e0065a627f40adfed99354ccb1b7a829e29ca1fe5db0fd1a2
- SHA512
  
  cb8ab5237c606b31a4daf4d67d065746cd33de5dfdb7627d5ed0f816e928850cdf19bfbe3559bc9da8a94d8865a03c6aa2656b7c8f3f6fc96ab765b2bf9aa8f8
Score

1^/10
behavioral3