neshta

General

Target

09876523456789.exe
Size

926KB
Sample

210923-ptg7kaecej
MD5

b8cdebc24a5ab6241373ae3bcc7d3053
SHA1

bb17815265e215c6de61489aca8019bb5ae473e0
SHA256

5521410a48148459362ab36b0fad3e61b1ca9b674339476eac02381ffbc04aa2
SHA512

b57809010853fce4520d4f0a144c5827f07e0105da22814480472d2d147006712867fcaead42e3aabaf88592344dad2ddca9771a5a616a105253cb5cd8b949e8

Score

10^/10

Malware Config

Targets

- Target
  
  09876523456789.exe
- Size
  
  926KB
- MD5
  
  b8cdebc24a5ab6241373ae3bcc7d3053
- SHA1
  
  bb17815265e215c6de61489aca8019bb5ae473e0
- SHA256
  
  5521410a48148459362ab36b0fad3e61b1ca9b674339476eac02381ffbc04aa2
- SHA512
  
  b57809010853fce4520d4f0a144c5827f07e0105da22814480472d2d147006712867fcaead42e3aabaf88592344dad2ddca9771a5a616a105253cb5cd8b949e8
Score

10^/10

neshta xmrig evasion miner persistence spyware stealer
- Detect Neshta Payload
- Modifies WinLogon for persistence
  persistence
- Modifies system executable filetype association
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2