neshta | d3664b62fd02bb44e29bbab0f2c6d91e

Sharing

Copy URL Twitter E-mail

General

Target

d3664b62fd02bb44e29bbab0f2c6d91e
Size

870KB
MD5

d3664b62fd02bb44e29bbab0f2c6d91e
SHA1

b65f4d7262dc4aa5fe914f2732631f04af61ba6f
SHA256

fa9814f79a0c1b2aeb19548b573726ae30e60a3344a4221c5e1486dcc375b3b1
SHA512

0a931fdde17983d4312c882bd8b547d0604d8e264b3404ce6f899c0c3de4e81e3b19342512b5d86e257e8d58743a1b7b9bcd8dd36b1638dd6637f93c7446abc0
SSDEEP

12288:6Dz0OqBLsToflY7+6fS8sxIxR14o4feSKv6gQuT:6U9LsTodY7084leBCgQO

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Files

d3664b62fd02bb44e29bbab0f2c6d91e
.exe windows:6 windows x64 arch:x64

35d4b9204e99fd3aaf9fe9c083d366f6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:d9:e7:55:85:0c:13:72:b4:8d:c1:82:a7:30:8b:ab
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/04/2013, 00:00

Not After

01/06/2016, 23:59

Subject

CN=Advanced Micro Devices\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Advanced Micro Devices\, Inc.,L=Sunnyvale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:25:50:e9:0f:6b:09:98:bc:9b:b9:f8:d0:20:99:6b:6c:61:b3:c7
Signer

Actual PE Digest

3f:25:50:e9:0f:6b:09:98:bc:9b:b9:f8:d0:20:99:6b:6c:61:b3:c7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\workarea\13.351.1007\apps\ccc2\Source\Utilities\CliStart\build\amd64\B_rel\CLIStart.pdb

Imports

psapi

EnumProcesses

kernel32

CreateEventA
SetEvent
GetTickCount
GlobalAddAtomA
GlobalDeleteAtom
SetLastError
FindFirstFileW
GetLocaleInfoW
LoadLibraryW
GetACP
ReadConsoleW
ReadFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
SetFilePointerEx
GetConsoleMode
GetLastError
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
HeapReAlloc
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
CreateProcessW
GetTickCount64
CloseHandle
QueryFullProcessImageNameA
OpenProcess
GetVersionExA
Sleep
OutputDebugStringA
FreeLibrary
GetProcAddress
LoadLibraryA
CreateFileW
GetConsoleCP
EncodePointer
QueryPerformanceCounter
GetModuleFileNameA
DeleteCriticalSection
GetFileType
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
HeapAlloc
HeapFree
SetEnvironmentVariableA
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
FindFirstFileExW
FindClose
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCommandLineA
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
RaiseException
GetCurrentThreadId
RtlPcToFileHeader
HeapSize
RtlUnwindEx
IsValidCodePage
GetOEMCP
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue

user32

wsprintfA
SetTimer
LoadStringW
DestroyMenu
TrackPopupMenu
SetMenuDefaultItem
InsertMenuW
GetCursorPos
CreatePopupMenu
SetForegroundWindow
LoadImageW
UnregisterHotKey
RegisterHotKey
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DefWindowProcA
SendMessageA
PostQuitMessage
IsWindow
FindWindowW
MessageBoxExA
DestroyWindow
KillTimer
DispatchMessageA
GetMessageA

advapi32

RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExW

shell32

SHGetSpecialFolderLocation
SHBindToParent
Shell_NotifyIconW
SHGetMalloc

ole32

CoInitialize
CoUninitialize
CoCreateInstance

Sections

.text
Size: 307KB - Virtual size: 307KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35d4b9204e99fd3aaf9fe9c083d366f6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4c:d9:e7:55:85:0c:13:72:b4:8d:c1:82:a7:30:8b:abCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

3f:25:50:e9:0f:6b:09:98:bc:9b:b9:f8:d0:20:99:6b:6c:61:b3:c7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 307KB - Virtual size: 307KB

.rdata Size: 111KB - Virtual size: 111KB

.data Size: 10KB - Virtual size: 21KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 286KB - Virtual size: 285KB

.reloc Size: 10KB - Virtual size: 9KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4c:d9:e7:55:85:0c:13:72:b4:8d:c1:82:a7:30:8b:ab
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

3f:25:50:e9:0f:6b:09:98:bc:9b:b9:f8:d0:20:99:6b:6c:61:b3:c7
Signer

.text
Size: 307KB - Virtual size: 307KB

.rdata
Size: 111KB - Virtual size: 111KB

.data
Size: 10KB - Virtual size: 21KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 286KB - Virtual size: 285KB

.reloc
Size: 10KB - Virtual size: 9KB