neshta

General

Target

f6a9d3e7add82c21ad66f2a0fbe8ce31330e2a284fabb69700ae5afd7188ac86
Size

473KB
Sample

250114-nqrfdsyqck
MD5

a2e4cfc601699cefb26f67410286dcde
SHA1

c9a0b105c932796c7d2c3259eadf58c4d06be514
SHA256

f6a9d3e7add82c21ad66f2a0fbe8ce31330e2a284fabb69700ae5afd7188ac86
SHA512

4ee517b0ffe411a51eeedaf22026bb38cbe5a4e4c19c8efda3bc706d105630333e42e4fe9a10ac80c8365895f7b98e22f531590b45f2f35ee0e20841116148b0
SSDEEP

12288:LLZ/P5ccF9lF0w6yfx+UjtOZGEn+FpNncUrOuF:vZ/R79/DTRdFrcU5

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\#HowToRecover.txt

Ransom Note

<?> What happend? All your files are encrypted and stolen. We recover your files in exchange for money. <?> What guarantees? You can contact us and send us an unimportant file less than 1 MG, We decrypt it as guarantee. If we do not send you the decryption software or delete stolen data, no one will pay us in future so we will keep our promise. <?> How we can contact you? [1] Email: You can write to us by email. Write your unique id in the subject. - [email protected] - [email protected] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>> Your ID: D96B9344BB800A9735F23CACB380621A <<<<<<<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> <!> Warnings: - Do not go to recovery companies. They secretly negotiate with us to decrypt a test file and use it to gain your trust and after you pay, they take the money and scam you. - Do not use third-party tools. They might damage your files and cause permanent data loss.

Emails

[email protected]

Extracted

Path

C:\Program Files\7-Zip\#HowToRecover.txt

Ransom Note

<?> What happend? All your files are encrypted and stolen. We recover your files in exchange for money. <?> What guarantees? You can contact us and send us an unimportant file less than 1 MG, We decrypt it as guarantee. If we do not send you the decryption software or delete stolen data, no one will pay us in future so we will keep our promise. <?> How we can contact you? [1] Email: You can write to us by email. Write your unique id in the subject. - [email protected] - [email protected] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>> Your ID: E1E2BE11DD3F863535F23CACB380621A <<<<<<<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> <!> Warnings: - Do not go to recovery companies. They secretly negotiate with us to decrypt a test file and use it to gain your trust and after you pay, they take the money and scam you. - Do not use third-party tools. They might damage your files and cause permanent data loss.

Emails

[email protected]

Targets

- Target
  
  f6a9d3e7add82c21ad66f2a0fbe8ce31330e2a284fabb69700ae5afd7188ac86
- Size
  
  473KB
- MD5
  
  a2e4cfc601699cefb26f67410286dcde
- SHA1
  
  c9a0b105c932796c7d2c3259eadf58c4d06be514
- SHA256
  
  f6a9d3e7add82c21ad66f2a0fbe8ce31330e2a284fabb69700ae5afd7188ac86
- SHA512
  
  4ee517b0ffe411a51eeedaf22026bb38cbe5a4e4c19c8efda3bc706d105630333e42e4fe9a10ac80c8365895f7b98e22f531590b45f2f35ee0e20841116148b0
- SSDEEP
  
  12288:LLZ/P5ccF9lF0w6yfx+UjtOZGEn+FpNncUrOuF:vZ/R79/DTRdFrcU5
Score

10^/10

neshta defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan upx
- Detect Neshta payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables use of System Restore points
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2