Behavioral task
behavioral1
Sample
eca75c6b06644464b0d337f88e3cdc59fe01ac59105a450c971082b0904aa7fa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eca75c6b06644464b0d337f88e3cdc59fe01ac59105a450c971082b0904aa7fa.exe
Resource
win10v2004-20220812-en
General
-
Target
eca75c6b06644464b0d337f88e3cdc59fe01ac59105a450c971082b0904aa7fa
-
Size
290KB
-
MD5
4000039f72ffe954a3273c130c136456
-
SHA1
35a2d82353abc5b1873b4773997889562754a588
-
SHA256
eca75c6b06644464b0d337f88e3cdc59fe01ac59105a450c971082b0904aa7fa
-
SHA512
baa612691e9fcca434401c8f1c72cc198183108bb359e0d021548df837ba6c7f22c14e02397e2a6c2594a22f048dc0143cda0419b63e49c0a77e6ddfc387dd5e
-
SSDEEP
3072:sr85CPCrvhbRcaC1U5Nf3wRqQxVNf3wRqQxVNf3wRqQxVNf3wRqQxVNf3wRqQxa:k9aTsT6PehPehPehPehPe4
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule sample family_neshta -
Neshta family
Files
-
eca75c6b06644464b0d337f88e3cdc59fe01ac59105a450c971082b0904aa7fa.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ