neshta | df85b949bca92255215a61d1b1b3a7c66d9cf75397ba961903289b903eadeb1f

Sharing

Copy URL Twitter E-mail

General

Target
df85b949bca92255215a61d1b1b3a7c66d9cf75397ba961903289b903eadeb1f
Size 22KB
Sample240708-bkdacsxeqe
SHA256 df85b949bca92255215a61d1b1b3a7c66d9cf75397ba961903289b903eadeb1f
MD5 8a462489ebae7ecce728a358da928c3d
SHA1 787e19e42c51f8cbd722f0afbd6f9a2e694a78c9
SHA512 fa3ce400755157e73b57d8ffd720e565a47854646a144f087eabc025360be8e5a85700a56bc4c882c65f30949d7ba2b3a293fdbe487a4f5a6c675430be4dc345
SSDEEP 384:otFfDseJ9ngtFexNbcdsbTfm8esAdHhjYpzCdNgr2rSOb1lVM5xQTcNPDANJ9c:oboevCF0bckgNjYpzCdA2RO52F6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
static1/unpack001/e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe

File Explorer

df85b949bca92255215a61d1b1b3a7c66d9cf75397ba961903289b903eadeb1f

.zip 22KB
e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe

.exe 40KB

df85b949bca92255215a61d1b1b3a7c66d9cf75397ba961903289b903eadeb1f

SHA256 df85b949bca92255215a61d1b1b3a7c66d9cf75397ba961903289b903eadeb1f
MD5 8a462489ebae7ecce728a358da928c3d
SHA1 787e19e42c51f8cbd722f0afbd6f9a2e694a78c9
SHA512 fa3ce400755157e73b57d8ffd720e565a47854646a144f087eabc025360be8e5a85700a56bc4c882c65f30949d7ba2b3a293fdbe487a4f5a6c675430be4dc345
SSDEEP 384:otFfDseJ9ngtFexNbcdsbTfm8esAdHhjYpzCdNgr2rSOb1lVM5xQTcNPDANJ9c:oboevCF0bckgNjYpzCdA2RO52F6
MD5 SHA1 SHA512 SSDEEP

Password

infected

e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe

SHA256 e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191
MD5 13b2b4014df7b0a92b170f5cbfa255c8
SHA1 00c3e8628491bbcd0154909123f98278895fdbda
SHA512 ec6d9f29c541f80550ab60a1873fd357559bf029bdd5a7b7ac1e94347a9d705ad1234a710fc0bd65567ede54dcf6306f5654758ddf454291328ce72110d44cd8
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJwZlN1URk:JxqjQ+P04wsmJC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Neshta payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

df85b949bca92255215a61d1b1b3a7c66d9cf75397ba961903289b903eadeb1f

e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191.exe

generic