neshta

General

Target

https://github.com/extatent/Phoenix-Nuker
Sample

231003-1ga39sff8z

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

11111

C2

45.92.1.32:20580

Attributes

auth_value
14e8b579d80fa30b32af4525cb815ce5

Extracted

Family

xworm

Version

3.1

C2

behind-him.at.ply.gg:27180

Attributes

install_file
USB.exe

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Targets

- Target
  
  https://github.com/extatent/Phoenix-Nuker
Score

10^/10

neshta quasar redline xworm 11111 evasion infostealer persistence rat spyware stealer trojan
- Detect Xworm Payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Downloads MZ/PE file
- Modifies Installed Components in the registry
  persistence
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1