neshta | 0x000800000001230b-80[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x000800000001230b-80.dat
Size

133KB
MD5

44affd0d82f9b8ef809053dba991a14a
SHA1

e63398e4b374ffc20a0d3fea78dac657bd49f6de
SHA256

d05edda2b7c085bbed3d5be4ba7b0dc00e807dfdcdcb67a30c9e24f96fed857b
SHA512

703a8da05add8c126f1b95808226021d572156b3b5e1ef7f2da0414535ec40953cd3656f060faba40c62811aa2189d396e130bcfccc42bc9b116ff2e3d96d049
SSDEEP

1536:JxqjQ+P04wsmJCSOojEwzGi1dD6DOgS4ygmlbrq+1NTZg:sr85CSOZi1dMzHynrq+1NTK

Score

10^/10

neshta njrat

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta
Njrat family
njrat

Files

0x000800000001230b-80.dat
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ