neshta | 04sample[.]zip

General

Target

04sample.zip
Size

4.4MB
MD5

882ffdf63e2d91043a9824818e729b0d
SHA1

cd9c822e0d61aad1b70797569d9f4c906d32bbc0
SHA256

b27b9d7337f3face7c17198879179b5d6ca0bfbf1e4270aaf27ae148366f6aea
SHA512

f1b47976e20c06b8d436a6c4ac8e48fbd41e492563ed255a7e7d5e08fa1fe308b094ac517af27db9e9bcaa417ec8eb6ab7ecc96c0e72b67f7806950fdfbaf902
SSDEEP

98304:Q+YqjuUlz6I0pjCTuzM66nrBnzY5NhpBLx4f1DjIk4HFLI5Aqr4:Eqyu63HB6nO57pBCf1vpKFsAb

Score

10^/10

agilenet neshta

Detect Neshta payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/sample.exe	family_neshta

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
static1/unpack001/sample.exe	agile_net

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/sample.exe

resource
unpack001/sample.exe