neshta

General

Target

60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe
Size

136KB
Sample

220205-hyjsmahac4
MD5

60d57c278bab55af5023a16578492fa5
SHA1

bb7a831d2ee669a52726737765d86bbba4074991
SHA256

de6b4fe5b4420970f1615f4d899a3c53e7817ce715db692583e2299f260661b2
SHA512

f6528e07a19bfd56343af4d73dff137207830bc0acafa3739f6ff85f88055ed44ddf97de870cc68004ca870c855c63a4bfe90d377636307455623b85f4731cf8

Score

10^/10

Malware Config

Targets

- Target
  
  60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe
- Size
  
  136KB
- MD5
  
  60d57c278bab55af5023a16578492fa5
- SHA1
  
  bb7a831d2ee669a52726737765d86bbba4074991
- SHA256
  
  de6b4fe5b4420970f1615f4d899a3c53e7817ce715db692583e2299f260661b2
- SHA512
  
  f6528e07a19bfd56343af4d73dff137207830bc0acafa3739f6ff85f88055ed44ddf97de870cc68004ca870c855c63a4bfe90d377636307455623b85f4731cf8
Score

10^/10

neshta phobos evasion persistence ransomware spyware stealer
- Detect Neshta Payload
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2