Overview

overview

10

Static

static

10

2024-05-27...ta.exe

windows7-x64

10

2024-05-27...ta.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-27_b2170fe582b4031cfa6871aa005350ea_makop_neshta

  • Size

    89KB

  • Sample

    240527-xahyraeg48

  • MD5

    b2170fe582b4031cfa6871aa005350ea

  • SHA1

    41381436bd2f7c049cf56316ab9b523e6e5e480c

  • SHA256

    ed76a964fbb871aa0c8b851461b2438c05a062bc2aced6fac72adb95066fe21b

  • SHA512

    9cbf499cc74d523bf3f9a33b9edbf0c430dc73a0dad0672cb752342614be137c65fd1e07cdba6ae6ccd474169746e7d21cc5d38b8dd445ef9f846ca6bd065511

  • SSDEEP

    1536:JxqjQ+P04wsmJCfJeYRLGlxaqE318HxZATvnsblYO6VC/:sr85Cf/RL+a318RZEvsbyOkC/

Score
10/10
makopneshtapersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-05-27_b2170fe582b4031cfa6871aa005350ea_makop_neshta

    • Size

      89KB

    • MD5

      b2170fe582b4031cfa6871aa005350ea

    • SHA1

      41381436bd2f7c049cf56316ab9b523e6e5e480c

    • SHA256

      ed76a964fbb871aa0c8b851461b2438c05a062bc2aced6fac72adb95066fe21b

    • SHA512

      9cbf499cc74d523bf3f9a33b9edbf0c430dc73a0dad0672cb752342614be137c65fd1e07cdba6ae6ccd474169746e7d21cc5d38b8dd445ef9f846ca6bd065511

    • SSDEEP

      1536:JxqjQ+P04wsmJCfJeYRLGlxaqE318HxZATvnsblYO6VC/:sr85Cf/RL+a318RZEvsbyOkC/

    Score
    10/10
    makopneshtapersistenceransomwarespywarestealer

    • Detect Neshta payload

    • MAKOP ransomware payload

    • Makop

      Ransomware family discovered by @VK_Intel in early 2020.

      ransomwaremakop

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks