neshta

General

Target

Server.exe
Size

37KB
Sample

220708-qtdptachcq
MD5

15e266280b3caa39b7829453bd771dd5
SHA1

21608df44ff71e39743c3ea4d07f32e0b8726f91
SHA256

5b275162c06c33d6601928193bb6bd880dd8e027cce78960b56ac69bd4376d27
SHA512

ada46e2a0df5662f591f896b3e0a90a6ec94788461d6d5052dee6d86b2fa26f9b84e7be6083844d3c234e717238bb8ea55ad9611846be9649f984fe9d2a1378a

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

лох

C2

4.tcp.eu.ngrok.io:17082

Mutex

3984571c29abcb362efb9e7c55ff9960

Attributes

reg_key
3984571c29abcb362efb9e7c55ff9960
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  37KB
- MD5
  
  15e266280b3caa39b7829453bd771dd5
- SHA1
  
  21608df44ff71e39743c3ea4d07f32e0b8726f91
- SHA256
  
  5b275162c06c33d6601928193bb6bd880dd8e027cce78960b56ac69bd4376d27
- SHA512
  
  ada46e2a0df5662f591f896b3e0a90a6ec94788461d6d5052dee6d86b2fa26f9b84e7be6083844d3c234e717238bb8ea55ad9611846be9649f984fe9d2a1378a
Score

10^/10

neshta njrat лох evasion persistence ransomware spyware stealer suricata trojan upx
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Message)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Message)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Sets desktop wallpaper using registry
  ransomware
behavioral1