17b368698ffc4be537f89bd9369f6f59.bin
- SHA256 bc2d9e8fed9f7a2daa82fff0429e67b40a50a43f3f1014240ddf4930b7e8c174
Password
infected
Behavioral task
behavioral1
Sample
新建文件夹/fast.exe
Resource
win7-20240705-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
新建文件夹/fast.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
新建文件夹/svchost.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
新建文件夹/svchost.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 17b368698ffc4be537f89bd9369f6f59.bin
- Size 63KB
- Sample240706-bg32ls1dnn
- SHA256 bc2d9e8fed9f7a2daa82fff0429e67b40a50a43f3f1014240ddf4930b7e8c174
- MD5 9cfc47f2c14f7024d74cb09ec44e5796
- SHA1 0f9a9147d8b90d5ead7483594f50b5583df969d9
- SHA512 5d93da9250592020bc55c26c67960340cabbacb9174881fc15e353113b8346bf5d7d03f77ab9d48ba70f123b5072b40b8e8b8a7fb1f5e46f871af03c57e8a444
- SSDEEP 1536:FFE881aPmpWCKOSLNxfdmR4Ykqr3K3Ss2ehzYGvKwvWa:FFG1aup0OSRm2YFraCs2euGiGWa
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 1 IoCs
resource yara_rule static1/unpack002/新建文件夹/svchost.com family_neshta - Neshta family
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/新建文件夹/fast.exe unpack002/新建文件夹/svchost.com
File Explorer
-
17b368698ffc4be537f89bd9369f6f59.bin.zip 63KB
-
c36f650adbd3d2274ff5b8a86874d845293041710e149e96b7cc11f584b22dd6.zip.zip 63KB
-
新建文件夹/fast.exe.exe 56KB
-
新建文件夹/svchost.com.exe 40KB
c36f650adbd3d2274ff5b8a86874d845293041710e149e96b7cc11f584b22dd6.zip
- SHA256 c36f650adbd3d2274ff5b8a86874d845293041710e149e96b7cc11f584b22dd6
- MD5 17b368698ffc4be537f89bd9369f6f59
- SHA1 ed3cea7a3f3ec7ac85ab73bd7006d49f3e66676b
- SHA512 15f6954b12afcd6bf7a2b611585742686a0b13b2b57dcc213ff035942b0dbd269b0ff7f1e6de115e5f5cd8e40e925a26e1985184f0d2206752f2dc549729435a
- SSDEEP 1536:YmDiCZ9S39tz6azEP3j5XbRGFVWhHLm6uYndduu:ZDi+a9tz6azEvlXbRGFVWlnuYeu
- MD5 SHA1 SHA512 SSDEEP
Password
infected
新建文件夹/fast.exe
- IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
- SHA256 0d990218e7ca3beff50d56a7cd3c6325c32e98413554e1b5614f101923706032
- MD5 9ad577d23f402be16acb2bdd9619aaf2
- SHA1 054e7451b8394d33bd59201653801fe1313a4841
- SHA512 b1be8815efdf59bc5fc2d0602cc01ce123edaea5b803c1733a33fdaf95b1172bb39f8cb762eb07c6d943b3e12789a053feb9c14a50ec8eb82fa491a55a7658ce
- SSDEEP 1536:CNeRBl5PT/rx1mzwRMSTdLpJCMBrzQM5+N:CQRrmzwR5JVUN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
12199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetEnumResourceW
WNetUseConnectionW
WNetOpenEnumW
WNetCloseEnum
ws2_32
ioctlsocket
getpeername
ntohl
select
WSAGetLastError
htons
recv
socket
closesocket
getsockopt
WSAAddressToStringW
htonl
connect
iphlpapi
GetIpAddrTable
winhttp
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
kernel32
FindClose
FindNextFileW
SystemTimeToFileTime
OpenProcess
FindFirstFileW
MoveFileW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
GetCurrentThreadId
GetLocalTime
ExitProcess
SetFilePointer
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
Sleep
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
CreateEventW
WaitForMultipleObjects
CloseHandle
SetFileAttributesW
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
DeleteCriticalSection
AllocConsole
WriteFile
WideCharToMultiByte
WriteConsoleW
GetStdHandle
CreateMutexW
CreateProcessW
GetCurrentProcess
SetHandleInformation
HeapFree
GetLocaleInfoW
ReadProcessMemory
TerminateProcess
GetModuleFileNameW
FlushFileBuffers
OpenMutexW
GetLastError
GetProcAddress
Process32FirstW
GetExitCodeThread
CreatePipe
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ReleaseMutex
GetVersion
DeleteFileW
GetCurrentProcessId
GetVolumeInformationW
ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapReAlloc
QueryPerformanceCounter
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
FreeSid
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
EqualSid
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupAccountSidW
AllocateAndInitializeSid
DuplicateTokenEx
RegQueryValueExW
shell32
ShellExecuteExW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
新建文件夹/svchost.com
- SHA256 40df0e0008b6342068604c7c159a1b4f81b149e4ddb674ceafe49c71b066c330
- MD5 13058802fd08204a986fefda371c984e
- SHA1 18ca69efc8c46fbcb8a8905ab5ddcb1c57db6bd1
- SHA512 9ad85c30155fceb6a9f6455e03d5bfeced9e3bc366f2bfba537c393e81dd664ee58cb5a480531da510cf620aea9514ccb6bcc232f6e551c3b9d1491d00672fb2
- SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJFbxYuXlBg:JxqjQ+P04wsmJCcbxZXL
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
32996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ