Extracted

• • Target

    Server.exe

  • Size

    37KB

  • MD5

    15e266280b3caa39b7829453bd771dd5

  • SHA1

    21608df44ff71e39743c3ea4d07f32e0b8726f91

  • SHA256

    5b275162c06c33d6601928193bb6bd880dd8e027cce78960b56ac69bd4376d27

  • SHA512

    ada46e2a0df5662f591f896b3e0a90a6ec94788461d6d5052dee6d86b2fa26f9b84e7be6083844d3c234e717238bb8ea55ad9611846be9649f984fe9d2a1378a

  Score

  10^/10

  neshtanjratлохevasionpersistenceransomwarespywarestealersuricatatrojanupx

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

    suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

    suricata

  • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Message)

    suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Message)

    suricata

  • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)

    suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)

    suricata

  • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

    suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

    suricata

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1