neshta

General

Target

2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe
Size

97KB
Sample

221012-lzg7zadbh7
MD5

54c2b90fd9364cd39cecff8ab112b825
SHA1

96c0c98dcce84e3bbec643083ce675664173bfd2
SHA256

2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba
SHA512

2e243d990243a80908531f3dc8910df796be6c87b964fbd84192e8161463d4460b552b5136379e789741f80abddfe77e77e81c4dcca9057881959a0d9dc1f3ce
SSDEEP

1536:JxqjQ+P04wsmJCGf0sKkr0EU5NeRBl5PT/rx1mzwRMSTdLpJUM:sr85CG07QRrmzwR5Jx

Score

10^/10

Malware Config

Targets

- Target
  
  2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe
- Size
  
  97KB
- MD5
  
  54c2b90fd9364cd39cecff8ab112b825
- SHA1
  
  96c0c98dcce84e3bbec643083ce675664173bfd2
- SHA256
  
  2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba
- SHA512
  
  2e243d990243a80908531f3dc8910df796be6c87b964fbd84192e8161463d4460b552b5136379e789741f80abddfe77e77e81c4dcca9057881959a0d9dc1f3ce
- SSDEEP
  
  1536:JxqjQ+P04wsmJCGf0sKkr0EU5NeRBl5PT/rx1mzwRMSTdLpJUM:sr85CG07QRrmzwR5Jx
Score

10^/10

neshta phobos evasion persistence ransomware spyware stealer
- Detect Neshta payload
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2