neshta

General

Target

781d0c8261c34c71edef1b6e6f1ddf8fe122857799fd5e4375a69bc2c5af01c2
Size

200KB
Sample

221202-r2sz5sbf7z
MD5

46dfcadc84fb0c9fe11db532862d11c2
SHA1

34f6a2904e5a846182fb814eeda8d5b626155ecb
SHA256

781d0c8261c34c71edef1b6e6f1ddf8fe122857799fd5e4375a69bc2c5af01c2
SHA512

c8ad6538a32300c293b0ed131f3f269bbdede737fe4e9f24b909588ce681a30d6b17d0a4c6dbd245410cb44caeb08e2457b5d01ecca54c27272dbc7eb4592c91
SSDEEP

3072:sr85CoxyVnojUWzawn3HRVysGCSgcyd7t9BrFr:k9oIV9WzaO3HDys3Bv19

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  781d0c8261c34c71edef1b6e6f1ddf8fe122857799fd5e4375a69bc2c5af01c2
- Size
  
  200KB
- MD5
  
  46dfcadc84fb0c9fe11db532862d11c2
- SHA1
  
  34f6a2904e5a846182fb814eeda8d5b626155ecb
- SHA256
  
  781d0c8261c34c71edef1b6e6f1ddf8fe122857799fd5e4375a69bc2c5af01c2
- SHA512
  
  c8ad6538a32300c293b0ed131f3f269bbdede737fe4e9f24b909588ce681a30d6b17d0a4c6dbd245410cb44caeb08e2457b5d01ecca54c27272dbc7eb4592c91
- SSDEEP
  
  3072:sr85CoxyVnojUWzawn3HRVysGCSgcyd7t9BrFr:k9oIV9WzaO3HDys3Bv19
Score

10^/10

neshta persistence spyware stealer sality backdoor evasion trojan upx
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2