Behavioral task
behavioral1
Sample
753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800.exe
Resource
win10v2004-20220812-en
General
-
Target
753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800
-
Size
525KB
-
MD5
259997e0bd458c6b6c4854108afa2bfc
-
SHA1
b80ed8abc3f34001bf07588b87abbdca2778678a
-
SHA256
753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800
-
SHA512
25784777e127e6871cecbbe3a15115c9468d8c7924b5729450d53a4480b977dc0676e04136b934b1e0c80c8d51e5accb6c67c81ffade27d63e6a71d47f8669d9
-
SSDEEP
12288:5Mb4Xd+Uh8ggdE8Ox4GoyPV4qOr1nBMIQn68LXmhLXm2:5MbVujg9u4GBPVLOr1nvM68DmhDm2
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule sample family_neshta -
Neshta family
Files
-
753bdffceb37877578d028200261ccf2def749d0df8ca2a4b6cd8470bd0af800.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ