neshta

General

Target

Cyborg ransomware Builder v2.1.bin.exe
Size

701KB
Sample

230311-ewc1hsac2w
MD5

3db3ee8509e8ce9c12936a1d5b82cca1
SHA1

a0d8b919d49d820b506864493b82fa78228afc3f
SHA256

b5aa1fa3949badd59b3c1a6f5a838c8eadf639c4199b7238179f0de512383217
SHA512

a5b4bead08d8da5eafd555bf2d04e56f498817710f31640a455199aacf5c8ebadc1b650616e82e5dcbda5cab9dc8d6e69fd5c1b46756c68934d9ecbd0ce54585
SSDEEP

12288:dqb8G7YdpkqP9MVLwGM8AMFt35+H16qtVLB/UEtWWIIk9O6dWuhDqWU/PuU6yy8O:dLrPRGM/gt350VVUNlhdWsqW8Piyy805

Score

10^/10

Malware Config

Targets

- Target
  
  Cyborg ransomware Builder v2.1.bin.exe
- Size
  
  701KB
- MD5
  
  3db3ee8509e8ce9c12936a1d5b82cca1
- SHA1
  
  a0d8b919d49d820b506864493b82fa78228afc3f
- SHA256
  
  b5aa1fa3949badd59b3c1a6f5a838c8eadf639c4199b7238179f0de512383217
- SHA512
  
  a5b4bead08d8da5eafd555bf2d04e56f498817710f31640a455199aacf5c8ebadc1b650616e82e5dcbda5cab9dc8d6e69fd5c1b46756c68934d9ecbd0ce54585
- SSDEEP
  
  12288:dqb8G7YdpkqP9MVLwGM8AMFt35+H16qtVLB/UEtWWIIk9O6dWuhDqWU/PuU6yy8O:dLrPRGM/gt350VVUNlhdWsqW8Piyy805
Score

10^/10

neshta ramnit banker persistence ransomware spyware stealer trojan upx worm
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2