neshta

General

Target

d5bb65b35daf83870a25646b84be125f497c655138b58f4ae4cbd249f2997aa0
Size

892KB
Sample

240702-f97ygsybna
MD5

e501c275814bfcb58fe845c38227d5c5
SHA1

e2dd36fd738326611cc8d80462451beb842b2d93
SHA256

d5bb65b35daf83870a25646b84be125f497c655138b58f4ae4cbd249f2997aa0
SHA512

435829c2248659e855cef6aca52061fb33c568f73b3668fcb87bcc33cc86f5c442a3e9ef7f840c3f54d813bf8c8b8c80c4139ae134a71245e269f186b550786a
SSDEEP

12288:WpJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9djS0TMS9:OJ39LyjbJkQFMhmC+6GD9d7n9

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

45.141.26.232:6666

Mutex

mbuYWmhQxC0l7ybb

Attributes

Install_directory
%ProgramData%
install_file
XClient.exe

aes.plain

Targets

- Target
  
  d5bb65b35daf83870a25646b84be125f497c655138b58f4ae4cbd249f2997aa0
- Size
  
  892KB
- MD5
  
  e501c275814bfcb58fe845c38227d5c5
- SHA1
  
  e2dd36fd738326611cc8d80462451beb842b2d93
- SHA256
  
  d5bb65b35daf83870a25646b84be125f497c655138b58f4ae4cbd249f2997aa0
- SHA512
  
  435829c2248659e855cef6aca52061fb33c568f73b3668fcb87bcc33cc86f5c442a3e9ef7f840c3f54d813bf8c8b8c80c4139ae134a71245e269f186b550786a
- SSDEEP
  
  12288:WpJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9djS0TMS9:OJ39LyjbJkQFMhmC+6GD9d7n9
Score

10^/10

neshta xworm execution persistence rat spyware stealer trojan
- Detect Xworm Payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Xworm

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Drops startup file

Executes dropped EXE

Modifies system executable filetype association

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2