neshta | NEAS[.]54b2b9046385ca367e334eb0fef75db0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.54b2b9046385ca367e334eb0fef75db0.exe
Size

153KB
MD5

54b2b9046385ca367e334eb0fef75db0
SHA1

019eed9d5c1522bb365d430949e7e607a02290dc
SHA256

7ff94cf13834e8b81baefe0fce7f5d11d202692f1e8ba9b556276425844c066a
SHA512

9dfaabac2b0da33e9f6bb7ce8b27fe192c5a3b7fd8d5f7749e87a3aafceebf3eb71db5c2b2eabc14d8aee01af905394b6b85599f843fb8a0cf20086780d61209
SSDEEP

1536:JxqjQ+P04wsmJCVlY/mTePiFkV8fEyPPCe7lqaG0TJ3hoOxqjQ+P04wsmJC:sr85CZe6FFd3CsbWr85C

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.54b2b9046385ca367e334eb0fef75db0.exe

Files

NEAS.54b2b9046385ca367e334eb0fef75db0.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ