neshta

General

Target

Server.exe
Size

36KB
Sample

220612-szvavsfahk
MD5

7d7c8113cb04320f4dcf35a3c0249c7f
SHA1

46c5ab4281ce97e99b2b77166f481d0e8aee08bb
SHA256

593c6b4b7701ca3bd566f8871686f8108293971125305e71f7679751faa7af83
SHA512

0dbb66b036e0410960a3cd698aaebbd0283713ca4ac41c8eb67484bfaf8168b46fd3581997da817cbcce1e762d4519bbf6e29ff053be222e096d1c93c263dccf

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

4.tcp.eu.ngrok.io:17260

Mutex

4c319362419eb0d3496d957c6a5b25af

Attributes

reg_key
4c319362419eb0d3496d957c6a5b25af
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  36KB
- MD5
  
  7d7c8113cb04320f4dcf35a3c0249c7f
- SHA1
  
  46c5ab4281ce97e99b2b77166f481d0e8aee08bb
- SHA256
  
  593c6b4b7701ca3bd566f8871686f8108293971125305e71f7679751faa7af83
- SHA512
  
  0dbb66b036e0410960a3cd698aaebbd0283713ca4ac41c8eb67484bfaf8168b46fd3581997da817cbcce1e762d4519bbf6e29ff053be222e096d1c93c263dccf
Score

10^/10

neshta njrat hacked evasion persistence spyware stealer suricata trojan
- Detect Neshta Payload
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
  suricata
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1