Extracted

• • Target

    78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361.exe

  • Size

    265KB

  • MD5

    3ac0d935228460fdc38bdab692d71b0c

  • SHA1

    d08f753af5b5d9be3352495189be6fd4914ad8e1

  • SHA256

    78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361

  • SHA512

    04376fc469808504a8071f0b9baa35c4f922d7b69c4d4c6e77309022f95cf916a80b758a6733154f36e8be59d928b93903eec47a6df32e96b2ef3b4b6f0fde54

  • SSDEEP

    6144:k9Pj5XJkcXV50DErs5xgTw7ozFz254WfRgzJmXrQwAN:akzDZGcoxfWfRglerQwAN

  Score

  10^/10

  neshtavenuspersistenceransomwarespywarestealerevasion

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Venus

    Venus is a ransomware first seen in 2022.

    ransomwarevenus

  • Venus Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Executes dropped EXE

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2