Behavioral task
behavioral1
Sample
b1b79c55a6eec49abb49ebe8ce4462f012c3a1b05e08d32d099ddd0acdf9a273.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b1b79c55a6eec49abb49ebe8ce4462f012c3a1b05e08d32d099ddd0acdf9a273.exe
Resource
win10v2004-20221111-en
General
-
Target
b1b79c55a6eec49abb49ebe8ce4462f012c3a1b05e08d32d099ddd0acdf9a273
-
Size
105KB
-
MD5
e6bd514e258270e1efa75dfd602534b0
-
SHA1
1fb59de4c4cacbcf02692b1d223c7b39d8e7d173
-
SHA256
b1b79c55a6eec49abb49ebe8ce4462f012c3a1b05e08d32d099ddd0acdf9a273
-
SHA512
0290b05a77e0f1be62e8c4b32db2d77614e943877d895a9e9f35407f06ff4994c909c5101903369a91fe9727f98a9fe77434f57d4c6d4b2aa0fcef27a89200f8
-
SSDEEP
768:YDyxqjQl/EMQt4Oei7RwsHxyP7nbxKuG2I/:Y2xqjQ+P04wsmJlg
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule sample family_neshta -
Neshta family
Files
-
b1b79c55a6eec49abb49ebe8ce4462f012c3a1b05e08d32d099ddd0acdf9a273.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.maxs01 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.maxs02 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.maxs03 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.maxs04 Size: - Virtual size:
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE