neshta | 41007d9e31bac888a4b18c533c77e3e7

Sharing

Copy URL

Twitter E-mail

General

Target

41007d9e31bac888a4b18c533c77e3e7
Size

453KB
MD5

41007d9e31bac888a4b18c533c77e3e7
SHA1

996e25590df259e7092e5811052051ddb8142dc1
SHA256

fd8899a515acfe74815c088213332499fc8212ad20a75da801b9897347b697b6
SHA512

de776375538a014451cca2b7f55a47fe2ef6d1b076b398a9cc0fcd1c02ba9dbbbca92cbb6668fb6ebc4207a588068db67270ea35dbe3ba0e0d4e8e1b2f1bb4ff
SSDEEP

6144:I9T92r9HxhhlBIVUb+Dy3bVArSDen49YTTB6gq3OAdFVNc0dS9TZ9T:ZFxrIS+oen49YTTAgSO

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Files

41007d9e31bac888a4b18c533c77e3e7
.exe windows:5 windows x64 arch:x64

b89a56e84608cb2f8252fb4e5068676f

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:05:ae:21:cd:c1:7b:9f:3c:f0:9d:7b:fc:65:9b:a3
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-02-2020 00:00

Not After

17-02-2023 12:00

Subject

CN=Glarysoft LTD,O=Glarysoft LTD,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:06:79:fd:2c:2e:aa:69:21:0f:c6:b7:95:ad:64:2f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-02-2020 00:00

Not After

17-02-2023 12:00

Subject

CN=Glarysoft LTD,OU=IT,O=Glarysoft LTD,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:4e:20:9f:c6:92:0b:56:c4:df:82:98:98:05:ec:bb:58:17:d7:df:49:ab:72:31:ac:97:be:72:aa:f4:83:f3
Signer

Actual PE Digest

0a:4e:20:9f:c6:92:0b:56:c4:df:82:98:98:05:ec:bb:58:17:d7:df:49:ab:72:31:ac:97:be:72:aa:f4:83:f3

Digest Algorithm

sha256

PE Digest Matches

false

3b:3c:05:ed:bd:a8:b6:ef:ca:38:64:f1:c3:4a:32:13:02:f7:0c:ed
Signer

Actual PE Digest

3b:3c:05:ed:bd:a8:b6:ef:ca:38:64:f1:c3:4a:32:13:02:f7:0c:ed

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mfc90u

ord570
ord762
ord1103
ord5658
ord4103
ord1519
ord285
ord3008
ord4145
ord4121
ord6422
ord3901
ord6424
ord4438
ord2110
ord2065
ord5713
ord3906
ord1025
ord5230
ord6363
ord5511
ord3932
ord1966
ord3005
ord5356
ord5358
ord2303
ord4050
ord4687
ord5362
ord5345
ord1211
ord911
ord1041
ord440
ord680
ord6438
ord2981
ord2016
ord3261
ord2515
ord799
ord1149
ord5696
ord2602
ord2325
ord779
ord265
ord266
ord1233
ord640
ord386
ord2797
ord2904
ord4419
ord2780
ord2907
ord2605
ord2711
ord2598
ord3818
ord3819
ord3809
ord2709
ord4051
ord4596
ord4372
ord3424
ord1071
ord3930
ord688
ord450
ord772
ord577
ord3783
ord4658
ord286
ord2533
ord5533
ord316
ord589
ord6281
ord4187
ord280
ord2378
ord791
ord887
ord789
ord2531
ord296
ord588
ord5532
ord777

msvcr90

memcpy
__CxxFrameHandler3
memset
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
fclose
ftell
fwrite
ferror
fprintf
fread
fopen
_errno
malloc
fputc
strrchr
rand
free
memcpy_s
wcscpy_s
printf
_strnicmp
wcsrchr
isalpha
_stricmp
wcsncpy_s
tolower
strstr
wcschr
_wcsicmp
?what@exception@std@@UEBAPEBDXZ
_purecall
swprintf_s
_invalid_parameter_noinfo
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@XZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
memmove_s
_CxxThrowException

kernel32

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateThread
SetEvent
WaitForSingleObject
GetLastError
CreateFileW
FormatMessageW
LocalFree
DeviceIoControl
Sleep
CreateEventW
ReadDirectoryChangesW
GetOverlappedResult
QueryPerformanceCounter
GetVolumeInformationW
GetDiskFreeSpaceW
FindFirstFileW
FindClose
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
GetDriveTypeW
ExpandEnvironmentStringsA
EnterCriticalSection
GlobalLock
GlobalUnlock
GlobalFree
GetModuleFileNameW
GetPrivateProfileStringW
CreateMutexW
CreateWaitableTimerW
SetWaitableTimer
ResumeThread
MapViewOfFile
UnmapViewOfFile
OpenProcess
DuplicateHandle
GetCurrentProcess
CreateFileMappingW
GetSystemInfo
GetTickCount
GetLogicalDrives
ConnectNamedPipe
SetLastError
CreateNamedPipeW
SetNamedPipeHandleState
WaitNamedPipeW
DisconnectNamedPipe
GlobalAlloc
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
GetStartupInfoW
CloseHandle
GetModuleHandleW
GetCurrentThreadId
ResetEvent
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
WriteFile
ReadFile
GetNamedPipeInfo

user32

TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
PostMessageW
DispatchMessageW

shell32

SHCreateDirectoryExA
SHGetDesktopFolder

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsA

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal

oleaut32

VariantInit
VariantClear

msvcp90

?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAXXZ
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@_KPEB_W0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@PEB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2_KB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA?AV12@_K0@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KD_K@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_NXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@PEBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K1@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_K@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEA_W_K@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@_W@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ

scanfile

GetFileInfoByFileNumber
StopScanFile
ScanAll
DeleteItemTree

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b89a56e84608cb2f8252fb4e5068676f

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0f:05:ae:21:cd:c1:7b:9f:3c:f0:9d:7b:fc:65:9b:a3Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:06:79:fd:2c:2e:aa:69:21:0f:c6:b7:95:ad:64:2fCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0a:4e:20:9f:c6:92:0b:56:c4:df:82:98:98:05:ec:bb:58:17:d7:df:49:ab:72:31:ac:97:be:72:aa:f4:83:f3Signer

3b:3c:05:ed:bd:a8:b6:ef:ca:38:64:f1:c3:4a:32:13:02:f7:0c:edSigner

Headers

DLL Characteristics

File Characteristics

Imports

mfc90u

msvcr90

kernel32

user32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp90

scanfile

Sections

.text Size: 243KB - Virtual size: 242KB

.rdata Size: 79KB - Virtual size: 79KB

.data Size: 2KB - Virtual size: 7KB

.pdata Size: 17KB - Virtual size: 17KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 2KB - Virtual size: 2KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0f:05:ae:21:cd:c1:7b:9f:3c:f0:9d:7b:fc:65:9b:a3
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:06:79:fd:2c:2e:aa:69:21:0f:c6:b7:95:ad:64:2f
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0a:4e:20:9f:c6:92:0b:56:c4:df:82:98:98:05:ec:bb:58:17:d7:df:49:ab:72:31:ac:97:be:72:aa:f4:83:f3
Signer

3b:3c:05:ed:bd:a8:b6:ef:ca:38:64:f1:c3:4a:32:13:02:f7:0c:ed
Signer

.text
Size: 243KB - Virtual size: 242KB

.rdata
Size: 79KB - Virtual size: 79KB

.data
Size: 2KB - Virtual size: 7KB

.pdata
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 2KB - Virtual size: 2KB