neshta

General

Target

Output.exe
Size

7.2MB
Sample

240916-f5vscs1clm
MD5

912ebadfef2b79a661c0fce42a1b27b0
SHA1

f8c897682d6c2cc498cd2ddc96468a0c60fd5ef7
SHA256

910d16a563b45f12c900a6d1c534e21bf5a0bb6a46485985ef6cd4eecd22cfa2
SHA512

8a6ce1f9a00fae3238506b98bc34ee093a8d44974e51fdd4c6fdffaa78fc70c47c9006c353ece33c4411c84e6deba34a9a7f9e4ce7cca8104a1b20b18bb5ff29
SSDEEP

196608:IYvleFwTit7oAsKbscSd27W3lXz2K47M2L:IXwTCUApPSd2WlXz21Q2

Score

10^/10

Malware Config

Targets

- Target
  
  Output.exe
- Size
  
  7.2MB
- MD5
  
  912ebadfef2b79a661c0fce42a1b27b0
- SHA1
  
  f8c897682d6c2cc498cd2ddc96468a0c60fd5ef7
- SHA256
  
  910d16a563b45f12c900a6d1c534e21bf5a0bb6a46485985ef6cd4eecd22cfa2
- SHA512
  
  8a6ce1f9a00fae3238506b98bc34ee093a8d44974e51fdd4c6fdffaa78fc70c47c9006c353ece33c4411c84e6deba34a9a7f9e4ce7cca8104a1b20b18bb5ff29
- SSDEEP
  
  196608:IYvleFwTit7oAsKbscSd27W3lXz2K47M2L:IXwTCUApPSd2WlXz21Q2
Score

10^/10

neshta credential_access discovery execution persistence ransomware spyware stealer revengerat trojan
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- RevengeRat Executable
  stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2