2fc2a8b0d91fd306fbe26f93a7e8320bc9ecb644dd21dae9267b0a20d37ec456
- SHA256 2fc2a8b0d91fd306fbe26f93a7e8320bc9ecb644dd21dae9267b0a20d37ec456
Password
infected
Behavioral task
behavioral1
Sample
Files_/7z.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Files_/7z.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
Files_/svchost.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Files_/svchost.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2fc2a8b0d91fd306fbe26f93a7e8320bc9ecb644dd21dae9267b0a20d37ec456
- Size 116KB
- Sample240708-kk8wpstcje
- SHA256 2fc2a8b0d91fd306fbe26f93a7e8320bc9ecb644dd21dae9267b0a20d37ec456
- MD5 ed78270733bf34a5b7e068ab67251a26
- SHA1 46dae0bd316b779699fec94e2e6b728d7e02bd42
- SHA512 8717fe8e87e986e6b2e167078821c5ad207d02c19e00176c9e33a57e6b003bf2d39a88290a964291ca0b865bde2162ea6911e2f67b4b7148bb6c9953a1fcc3d6
- SSDEEP 3072:6rLXlByslYMQAhXpIDLFVD8TYyKaeRwtx72in:6nX2s0wX+Lfwgaywtx7V
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 2 IoCs
resource yara_rule static1/unpack002/Files_/7z.exe family_neshta static1/unpack002/Files_/svchost.com family_neshta - Neshta family
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Files_/7z.exe unpack002/Files_/svchost.com
File Explorer
-
2fc2a8b0d91fd306fbe26f93a7e8320bc9ecb644dd21dae9267b0a20d37ec456.zip 116KB
-
1da1cf2e254e6fa1737041fd85ddef94314de58b423e9116a0beb762efe6a954.rar.rar 115KB
-
Files_/7z.exe.exe 205KB
-
Files_/svchost.com.exe 40KB
1da1cf2e254e6fa1737041fd85ddef94314de58b423e9116a0beb762efe6a954.rar
- SHA256 1da1cf2e254e6fa1737041fd85ddef94314de58b423e9116a0beb762efe6a954
- MD5 aaa24f65638596c5d9ffe93bf5de1b99
- SHA1 3ea943cd3934972ad0de9b7adecdacf8afb1ad80
- SHA512 7795a101d30a6f2fc35b916445f443ce9cdf74b3aa1d3b2d9b8d5d774c12c465f35ce2974055990a45f867f99a904c0dcfe78d50c06278daff92cc7ff67accac
- SSDEEP 3072:l0eZTG+NI95V7rTqY1t/V3Mtxj8dS7tP3UlJY2cUNpn2/:TI95VrqYH/ZM717tP3e/5e
- MD5 SHA1 SHA512 SSDEEP
Files_/7z.exe
- SHA256 dcd991e908b442aabbb173c5dcc29bb2f1444d64e128a989b281ebb9afc9a1b0
- MD5 9c74d05e6282ad6f1c31095dc24e82ae
- SHA1 27995b235ea2a5950a443e72df9e03e76ffe3aeb
- SHA512 a6f83e4d860dc1fc2f50ce6dfdd3c2b466018b71002eb701bfc54ee6d37119fa348bf59edb600c9c432aa0dfd5e6115393e023648957be002f920beb4ef8c775
- SSDEEP 3072:sr85CHiF2YuVvF193D17UCT1WxXG4JZHyL9AktY7+JJcfw320Ig0skKCnF:k9q2Ddp7h1KXJZHMtY7Og1A0sfCF
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Files_/svchost.com
- SHA256 e02cdfa2eda01b25a01fcfbda69c03225193d78cc5b6f618e828d3e1c9a83191
- MD5 13b2b4014df7b0a92b170f5cbfa255c8
- SHA1 00c3e8628491bbcd0154909123f98278895fdbda
- SHA512 ec6d9f29c541f80550ab60a1873fd357559bf029bdd5a7b7ac1e94347a9d705ad1234a710fc0bd65567ede54dcf6306f5654758ddf454291328ce72110d44cd8
- SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJwZlN1URk:JxqjQ+P04wsmJC
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ