neshta | 22ea886ab65911ed88536eefcf31207c[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
22ea886ab65911ed88536eefcf31207c.bin
Size 1.2MB
Sample240726-b67fbsydml
SHA256 7f16a5bd6e1956b144e143271b6b851adee6dcb71da4ccfdecf1466dce90602e
MD5 ccb85987ab12cdcdb18027218560a18e
SHA1 ef8a69c4edd8434adfef8a86b38dc272baa66da2
SHA512 ce1d247640973a2a5b348f419449d5eb8a8fd5d07ffe3efddb0963765458d828354dba90fc29248f072ba0a777fdac4932e3bf592ad8615677980452bfad9b88
SSDEEP 24576:loMe+tMACiWBpbKBHTCNh1sU5d2kugTrVgJbPT9IOjVBi9SCLW17/CXe:yqtMANKgONvsU5ZTrVWT9VvicUWdqXe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
static1/unpack001/c53465e676c760cb21cf0924d9aa7c86a82583fb58527be7c381660a7c4eb3e9.exe	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c53465e676c760cb21cf0924d9aa7c86a82583fb58527be7c381660a7c4eb3e9.exe

File Explorer

22ea886ab65911ed88536eefcf31207c.bin

.zip 1.2MB
c53465e676c760cb21cf0924d9aa7c86a82583fb58527be7c381660a7c4eb3e9.exe

.exe 1.3MB

22ea886ab65911ed88536eefcf31207c.bin

SHA256 7f16a5bd6e1956b144e143271b6b851adee6dcb71da4ccfdecf1466dce90602e
MD5 ccb85987ab12cdcdb18027218560a18e
SHA1 ef8a69c4edd8434adfef8a86b38dc272baa66da2
SHA512 ce1d247640973a2a5b348f419449d5eb8a8fd5d07ffe3efddb0963765458d828354dba90fc29248f072ba0a777fdac4932e3bf592ad8615677980452bfad9b88
SSDEEP 24576:loMe+tMACiWBpbKBHTCNh1sU5d2kugTrVgJbPT9IOjVBi9SCLW17/CXe:yqtMANKgONvsU5ZTrVWT9VvicUWdqXe
MD5 SHA1 SHA512 SSDEEP

Password

infected

c53465e676c760cb21cf0924d9aa7c86a82583fb58527be7c381660a7c4eb3e9.exe

SHA256 c53465e676c760cb21cf0924d9aa7c86a82583fb58527be7c381660a7c4eb3e9
MD5 22ea886ab65911ed88536eefcf31207c
SHA1 8c3790d77641d1c750d3cf5faf832e54e322feea
SHA512 7da3bb1955d91297bfa234bd3e706da7990008372dcbfb9fd18fc01fec8632d9c19748d3a57eb7555ed08109ad488f1c01bc9b278788ea6dd2b82853c6fb1f94
SSDEEP 24576:yKAN7MDBVaEJT84t6ve/K03KzStZdnQYwHFeP8x7PQhdrQdE2ttiJA:yKe7OVje7ve/HxQYwlWa7S4t1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Neshta payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

32996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

22ea886ab65911ed88536eefcf31207c.bin

c53465e676c760cb21cf0924d9aa7c86a82583fb58527be7c381660a7c4eb3e9.exe

generic