General

  • Target

    dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

  • Size

    94KB

  • Sample

    210925-ft79baadfj

  • MD5

    be56a866861c0cc91ff470f769d74d22

  • SHA1

    87ee58769b0c3eb629434ba0c5f9d3cd65accd4d

  • SHA256

    dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8

  • SHA512

    5be5f4ae7eb08a5a54bfa5dc0d000b94c69843e88b7e792350b0716390228df67ec2b1bb618b701a58cfe75fbaa5dd800d6c7f40a2cb4ea1d7f0a5b8eaf97d38

Malware Config

Extracted

Path

C:\Users\Public\Desktop\how_to_back_files.html

Ransom Note
Your personal ID ☠ Your files are encrypted! ☠ All your important data has been encrypted. To recover data you need decryptor. To get the decryptor you should: Send 1 test image or text file [email protected] or [email protected] . In the letter include your personal ID (look at the beginning of this document). We will give you the decrypted file and assign the price for decryption all files After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder. Only [email protected] and [email protected] can decrypt your files Do not trust anyone [email protected] and [email protected] Do not attempt to remove the program or run the anti-virus tools Attempts to self-decrypting files will result in the loss of your data Decoders other users are not compatible with your data, because each user's unique encryption key ���������

Targets

    • Target

      dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

    • Size

      94KB

    • MD5

      be56a866861c0cc91ff470f769d74d22

    • SHA1

      87ee58769b0c3eb629434ba0c5f9d3cd65accd4d

    • SHA256

      dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8

    • SHA512

      5be5f4ae7eb08a5a54bfa5dc0d000b94c69843e88b7e792350b0716390228df67ec2b1bb618b701a58cfe75fbaa5dd800d6c7f40a2cb4ea1d7f0a5b8eaf97d38

    • Detect Neshta Payload

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks