neshta | 3798c620106f7bcfb4b270c1f8cadfef5b7aea58440fc85d94e4161d71dabd7e | Triage

Resubmissions

12-01-2025 13:00

250112-p84zwasrhw 10

12-01-2025 12:57

250112-p63c9svrer 10

Sharing

General

Target

3798c620106f7bcfb4b270c1f8cadfef5b7aea58440fc85d94e4161d71dabd7eN.exe
Size

96KB
Sample

250112-p84zwasrhw
MD5

7e79a837d0d6342d0f0043c66e1d0640
SHA1

c7b196f0ddae16c70c15d429800edb04e42ab06b
SHA256

3798c620106f7bcfb4b270c1f8cadfef5b7aea58440fc85d94e4161d71dabd7e
SHA512

5b7569dbd4f01ea95f879fd643d9e72f139bd41d968713f66f7763ad92b394aacbc5e57bad0d5613640e398619360faeeb44ae9c7e25b7799ac2481effee92bf
SSDEEP

1536:JxqjQ+P04wsmJCJcadB73xzUobbpTiFbPCp5V3:sr85C+SB9Ti+p5V

Score

10^/10

neshta android discovery linux macos persistence spyware stealer

Malware Config

Targets

- Target
  
  3798c620106f7bcfb4b270c1f8cadfef5b7aea58440fc85d94e4161d71dabd7eN.exe
- Size
  
  96KB
- MD5
  
  7e79a837d0d6342d0f0043c66e1d0640
- SHA1
  
  c7b196f0ddae16c70c15d429800edb04e42ab06b
- SHA256
  
  3798c620106f7bcfb4b270c1f8cadfef5b7aea58440fc85d94e4161d71dabd7e
- SHA512
  
  5b7569dbd4f01ea95f879fd643d9e72f139bd41d968713f66f7763ad92b394aacbc5e57bad0d5613640e398619360faeeb44ae9c7e25b7799ac2481effee92bf
- SSDEEP
  
  1536:JxqjQ+P04wsmJCJcadB73xzUobbpTiFbPCp5V3:sr85C+SB9Ti+p5V
Score

10^/10

neshta discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespywarestealer

behavioral2

neshtadiscoverypersistencespywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10