neshta

General

Target

Zeppelinbggaehbcdj14_browsingExe.exe
Size

257KB
Sample

230802-wtl9vagf37
MD5

f66b738e1bfe1f8aab510abed850c424
SHA1

571f50fee0acad1da39fe06c75116461800cc719
SHA256

faa79c796c27b11c4f007023e50509662eac4bca99a71b26a9122c260abfb3c6
SHA512

dd8b63631b23a18f062e64c5e719ead52075964a2e465dfc2663425c97f0030ced80b6e48fdc84d54b2b8fb42513a9c9d0a60763eb2feca9f89c900b5bdcb97f
SSDEEP

6144:k957WWlJmcyfwAPWna4DQFu/U3buRKlemZ9DnGAevIGZi+YyJE1yR:O7WWKvhPWa4DQFu/U3buRKlemZ9DnGAy

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3408354897-1169622894-3874090110-1000\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Ransom Note

ALL YOUR FILES HAVE BEEN ENCRYPTED BY "VICE SOCIETY" All your important documents, photos, databases were stolen and encrypted. If you don't contact us in 7 days we will upload your files to darknet. The only method of recovering files is to purchase an unique private key. We are the only who can give you tool to recover your files. To proove that we have the key and it works you can send us 2 files and we decrypt it for free (not more than 2 MB each). This file should be not valuable! Write to email: [email protected] Alternative email: [email protected] Public emai:l [email protected] Our tor website: vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to ours) or you can become a victim of a scam.

Emails

[email protected]

URLs

http://vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion

Targets

- Target
  
  Zeppelinbggaehbcdj14_browsingExe.exe
- Size
  
  257KB
- MD5
  
  f66b738e1bfe1f8aab510abed850c424
- SHA1
  
  571f50fee0acad1da39fe06c75116461800cc719
- SHA256
  
  faa79c796c27b11c4f007023e50509662eac4bca99a71b26a9122c260abfb3c6
- SHA512
  
  dd8b63631b23a18f062e64c5e719ead52075964a2e465dfc2663425c97f0030ced80b6e48fdc84d54b2b8fb42513a9c9d0a60763eb2feca9f89c900b5bdcb97f
- SSDEEP
  
  6144:k957WWlJmcyfwAPWna4DQFu/U3buRKlemZ9DnGAevIGZi+YyJE1yR:O7WWKvhPWa4DQFu/U3buRKlemZ9DnGAy
Score

10^/10

neshta zeppelin persistence ransomware spyware stealer
- Detect Neshta payload
- Detects Zeppelin payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (358) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Renames multiple (370) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2