Extracted

Extracted

Extracted

• • Target

    2024-06-19_5e8587a7fc97df27848944e52274f209_darkgate_darkside_lockbit_neshta

  • Size

    1.2MB

  • MD5

    5e8587a7fc97df27848944e52274f209

  • SHA1

    29761dc4e6054a65deb4f9fefa57ca308946a2d3

  • SHA256

    6eac15e87caa4286eae1944a1473b8950a0e11e4d3a199285ae9826d92f9e537

  • SHA512

    bd9d471ea03fdbe4aa252a62bc740806b1b730bd49ff41ae3b8c9ad46c98102e5404eee88ecc876e7c85ff4d6be4b84e55d8343cdc6bef4334cdf8ba62f0ca3a

  • SSDEEP

    24576:nJ39LyjbJkQFMhmC+6GD9rzxjgdRpBq1hG98P67PNV3giFH6J1VjR3WdpbQrQyE7:nHyjtk2MYC5GD11j+RTFCT+aD/fGn9

  Score

  10^/10

  blackmatterlockbitneshtaxredbackdoordiscoverypersistenceransomwarespywarestealer

  • BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter

  • Blackmatter family

    blackmatter

  • Detect Neshta payload

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Lockbit family

    lockbit

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2