neshta

General

Target

0ee990e32b7b474afd0cf6b2d48cce335e1b16de6f1795934c180c0c521a41cd_NeikiAnalytics.exe
Size

577KB
Sample

240628-yyjevs1bka
MD5

5caca445d4a87ea8a881ad2cf02d4e70
SHA1

897a16e571c41aace2cfd27c714168d81e001f3e
SHA256

0ee990e32b7b474afd0cf6b2d48cce335e1b16de6f1795934c180c0c521a41cd
SHA512

05457a254f404a9b5312829a3105948a958ec8d6a4cdffefacbcd9bb7246083d2e11b434ce280e156e30c3522cefb5d752860b01645207dd53dacc7cf216e2dd
SSDEEP

6144:k9hBWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWdG/Wow7+JJUAX:IPw2PjCLe3a6Q70zbYow60E

Score

10^/10

Malware Config

Extracted

Family

predatorstealer

C2

http://rootadmins.000webhostapp.com/

Targets

- Target
  
  0ee990e32b7b474afd0cf6b2d48cce335e1b16de6f1795934c180c0c521a41cd_NeikiAnalytics.exe
- Size
  
  577KB
- MD5
  
  5caca445d4a87ea8a881ad2cf02d4e70
- SHA1
  
  897a16e571c41aace2cfd27c714168d81e001f3e
- SHA256
  
  0ee990e32b7b474afd0cf6b2d48cce335e1b16de6f1795934c180c0c521a41cd
- SHA512
  
  05457a254f404a9b5312829a3105948a958ec8d6a4cdffefacbcd9bb7246083d2e11b434ce280e156e30c3522cefb5d752860b01645207dd53dacc7cf216e2dd
- SSDEEP
  
  6144:k9hBWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWdG/Wow7+JJUAX:IPw2PjCLe3a6Q70zbYow60E
Score

10^/10

neshta predatorstealer collection discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- PredatorStealer
  Predator is a modular stealer written in C#.
  stealer predatorstealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Neshta payload

PredatorStealer

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2