neshta | 20bd2c0698859a509073f5146c859cbbb126e5517f682c41865ec9ebc6d37107 | Triage

Submit
Reports

Overview

overview

Static

static

20bd2c0698...07.exe

windows7_x64

20bd2c0698...07.exe

windows10_x64

Sharing

General

Target

20bd2c0698859a509073f5146c859cbbb126e5517f682c41865ec9ebc6d37107
Size

389KB
Sample

220130-jtgcdahagp
MD5

530f03121f88fd864114d023e90c4ce5
SHA1

79492aabb325b2b3d5208512ba332bed0b7ca90c
SHA256

20bd2c0698859a509073f5146c859cbbb126e5517f682c41865ec9ebc6d37107
SHA512

70b657e5b998cd599e1213f348963cd1fc93799d8d58c2feac313f32ff2195508fd186ed54e46e9d4da94ec01ec8181f0a6c10b6761c5c766b7a1e02eca8e90b

Score

10^/10

neshta sodinokibi persistence ransomware spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

20bd2c0698859a509073f5146c859cbbb126e5517f682c41865ec9ebc6d37107.exe

Resource

win7-en-20211208

neshta sodinokibi persistence ransomware spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

20bd2c0698859a509073f5146c859cbbb126e5517f682c41865ec9ebc6d37107.exe

Resource

win10-en-20211208

neshta sodinokibi persistence ransomware spyware stealer

windows10_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  20bd2c0698859a509073f5146c859cbbb126e5517f682c41865ec9ebc6d37107
- Size
  
  389KB
- MD5
  
  530f03121f88fd864114d023e90c4ce5
- SHA1
  
  79492aabb325b2b3d5208512ba332bed0b7ca90c
- SHA256
  
  20bd2c0698859a509073f5146c859cbbb126e5517f682c41865ec9ebc6d37107
- SHA512
  
  70b657e5b998cd599e1213f348963cd1fc93799d8d58c2feac313f32ff2195508fd186ed54e46e9d4da94ec01ec8181f0a6c10b6761c5c766b7a1e02eca8e90b
Score

10^/10

neshta sodinokibi persistence ransomware spyware stealer
- Detect Neshta Payload
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Sodin,Sodinokibi,REvil
  Ransomware with advanced anti-analysis and privilege escalation functionality.
  ransomware sodinokibi
- Sodinokibi/Revil sample
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtasodinokibipersistenceransomwarespywarestealer

behavioral2

neshtasodinokibipersistenceransomwarespywarestealer

© 2018-2024

Terms | Privacy