neshta | 1caf18d0d658598e9a9a98a99531c78f1aa015c8eb335c9627f15cf67064c862 | Triage

Sharing

General

Target

1caf18d0d658598e9a9a98a99531c78f1aa015c8eb335c9627f15cf67064c862
Size

140KB
MD5

fc9081f8b9545d5cdb3d6d737db6a835
SHA1

4fb7b2d72462464fef618997ea143038051df1a2
SHA256

1caf18d0d658598e9a9a98a99531c78f1aa015c8eb335c9627f15cf67064c862
SHA512

212184f725efc992799778d8d8e8022362391fc0eb22488380fff0f336b18e80d7527778fece7c2c75e99fbc07c7098ecc2a492fa50dcef8e3667d1c2b6d0e1d
SSDEEP

3072:sr85Cy1jczET888888888888W888888888889j97BXn6WC+vGod:k9y1oi888888888888W88888888888F

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta Payload 1 IoCs

Processes:

resource yara_rule

sample family_neshta
Neshta family
neshta

Files

1caf18d0d658598e9a9a98a99531c78f1aa015c8eb335c9627f15cf67064c862
.exe windows x86

Code Sign

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ