Overview

overview

10

Static

static

10

spider.exe

windows7-x64

10

spider.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    spider.exe.bin

  • Size

    226KB

  • Sample

    250116-m6q9wsxlfz

  • MD5

    2cc214c8c2ad42388b5dff8bc6242012

  • SHA1

    174f80f3deefc0da870f5b54d6a2495f83d755f4

  • SHA256

    3526381b95e916f2272049bdd849089e544231310671ce51b48dda0184a53df1

  • SHA512

    33835742ff31d5fcb251abb701c0b08e21b72ab7ed72e53275361fc13dacf5aa1376b3c3873b92e53d1d8aca355f6eb29b10623a3320568c5caf715bc69478b8

  • SSDEEP

    3072:sr85CDcSNm9V7Dm7i1j0XjuTxqJogYVqJogYg:k9Dc4m9tDm7myGq2Vq2g

Score
10/10
lockbitneshtadiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      spider.exe.bin

    • Size

      226KB

    • MD5

      2cc214c8c2ad42388b5dff8bc6242012

    • SHA1

      174f80f3deefc0da870f5b54d6a2495f83d755f4

    • SHA256

      3526381b95e916f2272049bdd849089e544231310671ce51b48dda0184a53df1

    • SHA512

      33835742ff31d5fcb251abb701c0b08e21b72ab7ed72e53275361fc13dacf5aa1376b3c3873b92e53d1d8aca355f6eb29b10623a3320568c5caf715bc69478b8

    • SSDEEP

      3072:sr85CDcSNm9V7Dm7i1j0XjuTxqJogYVqJogYg:k9Dc4m9tDm7myGq2Vq2g

    Score
    10/10
    lockbitneshtadiscoverypersistenceransomwarespywarestealer

    • Detect Neshta payload

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Lockbit family

      lockbit

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Rule to detect Lockbit 3.0 ransomware Windows payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks