neshta

General

Target

a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
Size

96KB
Sample

230405-m6bjfafh4z
MD5

7f72105941c8f10b6260ef142b95965f
SHA1

13024decb538649cec1f7f125907648c7ecf6b29
SHA256

a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850
SHA512

ca9a962b4d33721adfbec8a1c3988cf201c76eaffccbd2931fca4a9ef11007b664b3dda9c8cedfed170bcc716db0e84c313edd706ad8372e01b24b92ff4c97b9
SSDEEP

1536:JxqjQ+P04wsmJCUrrdFyYv6gJZNeRBl5PT/rx1mzwRMSTdLpJ0M:sr85CUvdFq0QRrmzwR5JR

Score

10^/10

Malware Config

Targets

- Target
  
  a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
- Size
  
  96KB
- MD5
  
  7f72105941c8f10b6260ef142b95965f
- SHA1
  
  13024decb538649cec1f7f125907648c7ecf6b29
- SHA256
  
  a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850
- SHA512
  
  ca9a962b4d33721adfbec8a1c3988cf201c76eaffccbd2931fca4a9ef11007b664b3dda9c8cedfed170bcc716db0e84c313edd706ad8372e01b24b92ff4c97b9
- SSDEEP
  
  1536:JxqjQ+P04wsmJCUrrdFyYv6gJZNeRBl5PT/rx1mzwRMSTdLpJ0M:sr85CUvdFq0QRrmzwR5JR
Score

10^/10

neshta phobos evasion persistence ransomware spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2