Overview

overview

10

Static

static

10

d03b6480f7...72.exe

windows7-x64

10

d03b6480f7...72.exe

windows10-2004-x64

10

Resubmissions

01/05/2024, 16:36

240501-t38s4ade65 10

01/05/2024, 11:44

240501-nwensaea6y 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d03b6480f718736bb08a677f951f067ad189e7d2c1f55a0c75336861bb96fa72

  • Size

    120KB

  • Sample

    240501-nwensaea6y

  • MD5

    a2b30b078b6186f9865e7953a3adf1b6

  • SHA1

    e2e3869b82737a7c7b066ab33e785b8341be0628

  • SHA256

    d03b6480f718736bb08a677f951f067ad189e7d2c1f55a0c75336861bb96fa72

  • SHA512

    00e59b330c4ae304be3db8b9c4578530c58f2d7f6730e1c64e0b7cfb00db0c29d6fecb10a54ab91374d7a8944711e7801c0ffa91f5dec247fe96a0b41460abba

  • SSDEEP

    3072:sr85CUsrQLOJgY8Zp8LHD4XWaNH71dLdG1iiFM2HrN/Dn:k9UsrQLOJgpZp8LHD4GaNH71dLdGiiFj

Score
10/10
neshtapersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\PerfLogs\Admin\readme_for_unlock.txt

Ransom Note
!!! ATTENTION !!! Your network is hacked and files are encrypted. Including the encrypted data we also downloaded other confidential information: Data of your employees, customers, partners, as well as accounting and other internal documentation of your company. All data is stored until you will pay. After payment we will provide you the programs for decryption and we will delete your data. If you refuse to negotiate with us (for any reason) all your data will be put up for sale. What you will face if your data gets on the black market: 1) The personal information of your employees and customers may be used to obtain a loan or purchases in online stores. 2) You may be sued by clients of your company for leaking information that was confidential. 3) After other hackers obtain personal data about your employees, social engineering will be applied to your company and subsequent attacks will only intensify. 4) Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. 5) You will forever lose the reputation. 6) You will be subject to huge fines from the government. You can learn more about liability for data loss here: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr-info.eu/ Courts, fines and the inability to use important files will lead you to huge losses. The consequences of this will be irreversible for you. Contacting the police will not save you from these consequences, but will only make your situation worse. You can get out of this situation with minimal losses To do this you must strictly observe the following rules: DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files. Such actions may DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it may also DAMAGE files. DO NOT Shutdown or Reboot the system this may DAMAGE files. DO NOT hire any third party negotiators (recovery/police, etc.) You need to contact us as soon as possible and start negotiations. Instructions for contacting our team: Download & Install TOR browser: https://torproject.org For contact us via LIVE CHAT open our > Website: http://cizedkjfk5zpiwnsxjjwllh2tfiwjttyrazi3spp6vairdkx52ydaqid.onion > Login: CLIENT > Password: U0fgTkwY9zmFhR43HYaF If Tor is restricted in your area, use VPN�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
URLs

https://gdpr-info.eu/

http://cizedkjfk5zpiwnsxjjwllh2tfiwjttyrazi3spp6vairdkx52ydaqid.onion

Targets

    • Target

      d03b6480f718736bb08a677f951f067ad189e7d2c1f55a0c75336861bb96fa72

    • Size

      120KB

    • MD5

      a2b30b078b6186f9865e7953a3adf1b6

    • SHA1

      e2e3869b82737a7c7b066ab33e785b8341be0628

    • SHA256

      d03b6480f718736bb08a677f951f067ad189e7d2c1f55a0c75336861bb96fa72

    • SHA512

      00e59b330c4ae304be3db8b9c4578530c58f2d7f6730e1c64e0b7cfb00db0c29d6fecb10a54ab91374d7a8944711e7801c0ffa91f5dec247fe96a0b41460abba

    • SSDEEP

      3072:sr85CUsrQLOJgY8Zp8LHD4XWaNH71dLdG1iiFM2HrN/Dn:k9UsrQLOJgpZp8LHD4GaNH71dLdGiiFj

    Score
    10/10
    neshtapersistenceransomwarespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (381) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks