neshta | f78477275d79d0eead0b62d3355df9be273518c54eeac3719a97823365cee858

Sharing

Copy URL Twitter E-mail

General

Target
f78477275d79d0eead0b62d3355df9be273518c54eeac3719a97823365cee858
Size 371KB
Sample221012-y7hvpabcbm
SHA256 4929409c92d72721b3bee5b399b0f88a547c56f95a6369e0901cee26a83f3a03
MD5 0d31df1863f97a604a39b08f95e2f3b9
SHA1 0952c5b3bb51208a7fc2945ce912d08b4436088e
SHA512 2f0caf799b541c6dd055fabfb7fb9be03c25f868bf19a2f10397baac202f086e1149837f336f18a69293232aeaea0d5c64e269a6570c1843cc0463c513dbdcb7
SSDEEP 6144:FObzf8f+L0O/7rxgj5IveLe6SE8Bvx090JTs7Gi4aMC7QGS3s2uMAedtN5iou:b2Yugj5IeNSE8Bu+Op4RC23Z9AkN5iN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
static1/unpack001/f78477275d79d0eead0b62d3355df9be273518c54eeac3719a97823365cee858	family_neshta

Neshta family
neshta

File Explorer

f78477275d79d0eead0b62d3355df9be273518c54eeac3719a97823365cee858

.zip 371KB
f78477275d79d0eead0b62d3355df9be273518c54eeac3719a97823365cee858

.exe 488KB

f78477275d79d0eead0b62d3355df9be273518c54eeac3719a97823365cee858

SHA256 4929409c92d72721b3bee5b399b0f88a547c56f95a6369e0901cee26a83f3a03
MD5 0d31df1863f97a604a39b08f95e2f3b9
SHA1 0952c5b3bb51208a7fc2945ce912d08b4436088e
SHA512 2f0caf799b541c6dd055fabfb7fb9be03c25f868bf19a2f10397baac202f086e1149837f336f18a69293232aeaea0d5c64e269a6570c1843cc0463c513dbdcb7
SSDEEP 6144:FObzf8f+L0O/7rxgj5IveLe6SE8Bvx090JTs7Gi4aMC7QGS3s2uMAedtN5iou:b2Yugj5IeNSE8Bu+Op4RC23Z9AkN5iN
MD5 SHA1 SHA512 SSDEEP

Detect Neshta payload

f78477275d79d0eead0b62d3355df9be273518c54eeac3719a97823365cee858

SHA256 f78477275d79d0eead0b62d3355df9be273518c54eeac3719a97823365cee858
MD5 4c596d32f75e3a84e48c36e8fc8025fd
SHA1 6a03c9d53e10c752b66b677e528fbcd1a70a6d0c
SHA512 0b159fe0b1766c27c89f65069fb3d33a59b3fc3efd7519629497df3ec07eda1b938819a2b0faa6cf2c305a736c3c93d409d42901c744644e11867a06bd7796c2
SSDEEP 6144:k9Cq6V1jfMRWYYIveLu6SE8jvx09SJTs7ci4aMC7WGS3swOco36deigavwVfe5K0:fV1DopYIe1SE8juQOf4RCw3dJTxuuB
MD5 SHA1 SHA512 SSDEEP

windows x86

Detect Neshta payload

Minor OS version

Major OS version

Entry point

32996

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ