neshta | 6edf8aaaaeb37888ac3dce91ac29025fa6f63c33162e306ec4825ab43c0bd6d2 | Triage

Sharing

General

Target

6edf8aaaaeb37888ac3dce91ac29025fa6f63c33162e306ec4825ab43c0bd6d2
Size

498KB
MD5

4c0c4bcbb9e26afded6c5d8a8a316670
SHA1

37019e78c38c7b916e82259f50f028fc09a9357e
SHA256

6edf8aaaaeb37888ac3dce91ac29025fa6f63c33162e306ec4825ab43c0bd6d2
SHA512

5ee2b2e0d37cc2fff700da0a61c4ec86576503d5c53fb922619eadcbd31b680903a2e6e06ad81608cba10f8a88d5bd40c4da33e16ba40137722a7ecbd36ccbbd
SSDEEP

6144:6kECCdJFSMA4WxY7iNCQilD5gBJhDaZKIQqaaXYkzRLBkaNG83Dz37lSF/JdrlsA:sJA4WY7tlDq1DaZk0bzz37lSZUUKuHP

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

Processes:

resource yara_rule

sample family_neshta
Neshta family
neshta
NSIS installer 1 IoCs
installer

Processes:

resource yara_rule

sample nsis_installer_2

Files

6edf8aaaaeb37888ac3dce91ac29025fa6f63c33162e306ec4825ab43c0bd6d2
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lif
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE