Overview

overview

10

Static

static

10

e8013dbbfa...4a.exe

windows7-x64

10

e8013dbbfa...4a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8013dbbfa2755e6cb962d3babb23c9d3f0f7ca615c887cd2cdbd9011cd5d44a

  • Size

    89KB

  • Sample

    240203-vr3clsgfdk

  • MD5

    a6bd87588e880f65273180ce92385fa1

  • SHA1

    2c28e8a0557deb38741dc0eb805754814c81b7de

  • SHA256

    e8013dbbfa2755e6cb962d3babb23c9d3f0f7ca615c887cd2cdbd9011cd5d44a

  • SHA512

    d91f946d5703d57b8cd72c7a92727e3f3182106ab644847b5f5b8db1b58ccc10f5a5168d3b8ca49beb61a384d3bca8a478596fbc8d55836955470517032cfcd2

  • SSDEEP

    1536:JxqjQ+P04wsmJCvTT2sd5sxaS318HxZATvnsblYO4/+:sr85CHRd5Kr318RZEvsbyOk+

Score
10/10
makopneshtapersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      e8013dbbfa2755e6cb962d3babb23c9d3f0f7ca615c887cd2cdbd9011cd5d44a

    • Size

      89KB

    • MD5

      a6bd87588e880f65273180ce92385fa1

    • SHA1

      2c28e8a0557deb38741dc0eb805754814c81b7de

    • SHA256

      e8013dbbfa2755e6cb962d3babb23c9d3f0f7ca615c887cd2cdbd9011cd5d44a

    • SHA512

      d91f946d5703d57b8cd72c7a92727e3f3182106ab644847b5f5b8db1b58ccc10f5a5168d3b8ca49beb61a384d3bca8a478596fbc8d55836955470517032cfcd2

    • SSDEEP

      1536:JxqjQ+P04wsmJCvTT2sd5sxaS318HxZATvnsblYO4/+:sr85CHRd5Kr318RZEvsbyOk+

    Score
    10/10
    makopneshtapersistenceransomwarespywarestealer

    • Detect Neshta payload

    • MAKOP ransomware payload

    • Makop

      Ransomware family discovered by @VK_Intel in early 2020.

      ransomwaremakop

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks