neshta

General

Target

4d9cf0e60b2fe13cc8f5dd36e1b0e771d6b6e001e5f95c5a3dede78cdcdbd01c_NeikiAnalytics.exe
Size

577KB
Sample

240701-nc3w9syckf
MD5

f9330a18b7aee16a7f167d0d0a8f4a60
SHA1

1341533d0f67aa8866d141028310a374e257e7e2
SHA256

4d9cf0e60b2fe13cc8f5dd36e1b0e771d6b6e001e5f95c5a3dede78cdcdbd01c
SHA512

8141da7a5d651dfae69879adba492e9b0bff4406b8e233d5c468ace1a700d248f16bb6697b703c124957829b0b8e3cb64bf89714c422a63ecfc9516136aebdff
SSDEEP

6144:k9hBWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWdG/Wow7+JJUCX:IPw2PjCLe3a6Q70zbYow60u

Score

10^/10

Malware Config

Extracted

Family

predatorstealer

C2

http://ghostghostcom.000webhostapp.com/

Targets

- Target
  
  4d9cf0e60b2fe13cc8f5dd36e1b0e771d6b6e001e5f95c5a3dede78cdcdbd01c_NeikiAnalytics.exe
- Size
  
  577KB
- MD5
  
  f9330a18b7aee16a7f167d0d0a8f4a60
- SHA1
  
  1341533d0f67aa8866d141028310a374e257e7e2
- SHA256
  
  4d9cf0e60b2fe13cc8f5dd36e1b0e771d6b6e001e5f95c5a3dede78cdcdbd01c
- SHA512
  
  8141da7a5d651dfae69879adba492e9b0bff4406b8e233d5c468ace1a700d248f16bb6697b703c124957829b0b8e3cb64bf89714c422a63ecfc9516136aebdff
- SSDEEP
  
  6144:k9hBWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWdG/Wow7+JJUCX:IPw2PjCLe3a6Q70zbYow60u
Score

10^/10

neshta predatorstealer collection discovery persistence spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- PredatorStealer
  Predator is a modular stealer written in C#.
  stealer predatorstealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Neshta payload

PredatorStealer

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2