General
-
Target
ffbb6c4d8d704a530bdd557890f367ad904c09c03f53fda5615a7208a0ea3e4d
-
Size
191KB
-
MD5
0859a78bb06a77e7c6758276eafbefd9
-
SHA1
a72e18efa33f1e3438dbb4451c335d487cbd4082
-
SHA256
ffbb6c4d8d704a530bdd557890f367ad904c09c03f53fda5615a7208a0ea3e4d
-
SHA512
49ca427843dd5c5cefef3d50206b0cf772152f78f82bf42a927aa0d70ceed1c1e828cb20f7f2e8dce58bf2c33e14ff75ec74319d15671b9268e0c18457722c5d
-
SSDEEP
3072:sr85CNR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/3Q1m3/OyVPX/1jTCA:k93OyysNmJyXsqqD/ls/32q/1VPn
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
-
Detects command variations typically used by ransomware 1 IoCs
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
-
Detects executables containing commands for clearing Windows Event Logs 1 IoCs
-
Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
-
Neshta family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
ffbb6c4d8d704a530bdd557890f367ad904c09c03f53fda5615a7208a0ea3e4d
Headers
Sections