neshta | 09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700

Sharing

Copy URL Twitter E-mail

General

Target
09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700
Size 2.4MB
Sample221018-pptpssfge9
SHA256 09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700
MD5 96043be47e7675254c087b7066a4794c
SHA1 6469980d6a93b331076ebc682356db3d728dbb27
SHA512 8920aff5c83ca2433fa1b3a8633986408dca33948d1b307c296587795b6f902a0bdf06ca2053a238d4914b1ab39c4ac56d618f95bf0e986a2c9c98622d92c712
SSDEEP 49152:S+65x7a/n6DbGITGf5MTGa2xEdjxucTMYSH+hHftIom+i89sYpV:QUCbGIstaQEdhotH8HftIX+i891V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700

.exe 2.4MB

09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700

SHA256 09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700
MD5 96043be47e7675254c087b7066a4794c
SHA1 6469980d6a93b331076ebc682356db3d728dbb27
SHA512 8920aff5c83ca2433fa1b3a8633986408dca33948d1b307c296587795b6f902a0bdf06ca2053a238d4914b1ab39c4ac56d618f95bf0e986a2c9c98622d92c712
SSDEEP 49152:S+65x7a/n6DbGITGf5MTGa2xEdjxucTMYSH+hHftIom+i89sYpV:QUCbGIstaQEdhotH8HftIX+i891V
MD5 SHA1 SHA512 SSDEEP

windows x86

Detect Neshta payload
NSIS installer

installer

Minor OS version

Major OS version

Entry point

32996

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ