neshta

General

Target

Server.exe
Size

37KB
Sample

220708-rbwcksdbdp
MD5

15e266280b3caa39b7829453bd771dd5
SHA1

21608df44ff71e39743c3ea4d07f32e0b8726f91
SHA256

5b275162c06c33d6601928193bb6bd880dd8e027cce78960b56ac69bd4376d27
SHA512

ada46e2a0df5662f591f896b3e0a90a6ec94788461d6d5052dee6d86b2fa26f9b84e7be6083844d3c234e717238bb8ea55ad9611846be9649f984fe9d2a1378a

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

лох

C2

4.tcp.eu.ngrok.io:17082

Mutex

3984571c29abcb362efb9e7c55ff9960

Attributes

reg_key
3984571c29abcb362efb9e7c55ff9960
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  37KB
- MD5
  
  15e266280b3caa39b7829453bd771dd5
- SHA1
  
  21608df44ff71e39743c3ea4d07f32e0b8726f91
- SHA256
  
  5b275162c06c33d6601928193bb6bd880dd8e027cce78960b56ac69bd4376d27
- SHA512
  
  ada46e2a0df5662f591f896b3e0a90a6ec94788461d6d5052dee6d86b2fa26f9b84e7be6083844d3c234e717238bb8ea55ad9611846be9649f984fe9d2a1378a
Score

10^/10

neshta njrat лох bootkit evasion persistence spyware stealer suricata trojan
- Detect Neshta payload
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- UAC bypass
  evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
  suricata
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1