neshta | 240426-2rzeaaee8y_pw_infected[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
240426-2rzeaaee8y_pw_infected.zip
Size 63KB
Sample240604-cecmbaab62
SHA256 daaf6cc50e157764857da598cdf19a40fb410aa0e3cef84e1a3aff98d86b6fb6
MD5 4fa1e3b4bc67302932e27dc106cae3d9
SHA1 89ab3c5c910b93005d7e9a966f3491d897e8c51e
SHA512 51a925fc0489a1006cdd0c9f7e004fe5ac19a9ca04118906abffc73b0374543d4505fb4acc1245207f69e4a27a852d9d1092a4534ed4718967b84028f89bc5f2
SSDEEP 1536:Pdt8oTDPahcMQtmiBfob4pjw4j5ye7hLhnko2AkVRNl03pSB0A3D4:PL9DCJ3MfobEjaeLnmA+RiUb4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
static1/unpack002/2024-04-26_5ccd142bdebf68e32028807f80f86fa7_neshta_phobos	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/2024-04-26_5ccd142bdebf68e32028807f80f86fa7_neshta_phobos

File Explorer

240426-2rzeaaee8y_pw_infected.zip

.zip 63KB
240426-w39rhahe53_pw_infected.zip

.zip 63KB
2024-04-26_5ccd142bdebf68e32028807f80f86fa7_neshta_phobos

.exe 96KB

240426-2rzeaaee8y_pw_infected.zip

SHA256 daaf6cc50e157764857da598cdf19a40fb410aa0e3cef84e1a3aff98d86b6fb6
MD5 4fa1e3b4bc67302932e27dc106cae3d9
SHA1 89ab3c5c910b93005d7e9a966f3491d897e8c51e
SHA512 51a925fc0489a1006cdd0c9f7e004fe5ac19a9ca04118906abffc73b0374543d4505fb4acc1245207f69e4a27a852d9d1092a4534ed4718967b84028f89bc5f2
SSDEEP 1536:Pdt8oTDPahcMQtmiBfob4pjw4j5ye7hLhnko2AkVRNl03pSB0A3D4:PL9DCJ3MfobEjaeLnmA+RiUb4
MD5 SHA1 SHA512 SSDEEP

Password

infected

2024-04-26_5ccd142bdebf68e32028807f80f86fa7_neshta_phobos

SHA256 d76da951ef6377b92f18c4bac0d69649ad87d4b38505d01084e74e225ef1c23b
MD5 5ccd142bdebf68e32028807f80f86fa7
SHA1 362e35e58969ab6e6d9b232638868dd2217924a6
SHA512 417a8ebe48f4bc787fb958e56d507864659507fc6188675a9f7e4b1b36b4ae68f3bbdff4318e0787987f95348ce9d95456fdcd243057353561dbe573de6f5960
SSDEEP 1536:JxqjQ+P04wsmJCHxaQa5Y5pfHbRZMwNeRBl5PT/rx1mzwRMSTdLpJmM:sr85CwV5Y5ptPQRrmzwR5Jz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Neshta payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

240426-2rzeaaee8y_pw_infected.zip

240426-w39rhahe53_pw_infected.zip

2024-04-26_5ccd142bdebf68e32028807f80f86fa7_neshta_phobos

generic