neshta

General

Target

7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9
Size

1.3MB
Sample

220212-assvcaeae5
MD5

2140adb39cf86f635f1c2d16dbe89970
SHA1

0aa79344a9f2f0a76f522b414701a74dab070167
SHA256

7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9
SHA512

29d3991345197f6d482597cfb42349737eacb339f2e77f15f625622a80347de835c5198d4d3980319e3ab63613e9d1a10a8b3558f0c71643e8d5a6bae54bfa66

Score

10^/10

Malware Config

Extracted

Path

C:\Decryption-Guide.txt

Ransom Note

Your Files Are Has Been Locked Your Files Has Been Encrypted with cryptography Algorithm If You Need Your Files And They are Important to You, Dont be shy Send Me an Email Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : RSAKEY-SE-24r6t523 pr RSAKEY.KEY) to Make Sure Your Files Can be Restored Make an Agreement on Price with me and Pay Get Decryption Tool + RSA Key AND Instruction For Decryption Process Attention: 1- Do Not Rename or Modify The Files (You May loose That file) 2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time ) 3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files 4-Do Not Always Trust to Middle mans and negotiators (some of them are good but some of them agree on 4000usd for example and Asked 10000usd From Client) this Was happened Your Case ID :MJ-JG0891657423 OUR Email :[email protected]

Emails

[email protected]

Extracted

Path

C:\Decryption-Guide.txt

Ransom Note

Your Files Are Has Been Locked Your Files Has Been Encrypted with cryptography Algorithm If You Need Your Files And They are Important to You, Dont be shy Send Me an Email Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : RSAKEY-SE-24r6t523 pr RSAKEY.KEY) to Make Sure Your Files Can be Restored Make an Agreement on Price with me and Pay Get Decryption Tool + RSA Key AND Instruction For Decryption Process Attention: 1- Do Not Rename or Modify The Files (You May loose That file) 2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time ) 3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files 4-Do Not Always Trust to Middle mans and negotiators (some of them are good but some of them agree on 4000usd for example and Asked 10000usd From Client) this Was happened Your Case ID :MJ-RZ5964312708 OUR Email :[email protected]

Emails

[email protected]

Targets

- Target
  
  7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9
- Size
  
  1.3MB
- MD5
  
  2140adb39cf86f635f1c2d16dbe89970
- SHA1
  
  0aa79344a9f2f0a76f522b414701a74dab070167
- SHA256
  
  7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9
- SHA512
  
  29d3991345197f6d482597cfb42349737eacb339f2e77f15f625622a80347de835c5198d4d3980319e3ab63613e9d1a10a8b3558f0c71643e8d5a6bae54bfa66
Score

10^/10

neshta evasion persistence ransomware spyware stealer
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2