neshta | qp[.]rar | Triage™

resource	yara_rule
static1/unpack001/qp/qparser-2.4.5a.exe	family_neshta

resource	yara_rule
static1/unpack001/qp/result/24-08-2025/result_hgci_filtered.txt	diamondfox

resource
unpack001/qp/qparser-2.4.5a.exe

qp.rar

SHA256 177af37eb78d1f3fbfddfba67a2565858e8a47402ef0851ac12e5bdf4720b4c5
MD5 022172c89c0e8864d502ce0ebbc26e8d
SHA1 4c051510ccdc2624dc51a9d992dd0a3071b6f1bb
SHA512 d32b7e4cae3cab15203046f7d4106ad45a1c60e74aeba8015e598b4e129bef56c2377d73b06998a66ee9080a7b95adade401b0e34307020a3e308fbe5de80e44
SSDEEP 393216:YqGv7V1GQmHLIuCyXXkTgKndFr5A5SRCFKws9pvv8d5rUnJ:/TXkrnfiIgmpH8EJ
MD5 SHA1 SHA512 SSDEEP

qp/anti_public.db

SHA256 897d5e72e9ff9b4a5b3eeb5dee781d99c5112306f24b4a9f1fadc78b88864374
MD5 154b986ec86ba9d699abbfccdaedbf42
SHA1 0c52259df6e57aa9e58a1a32117757b27faf944a
SHA512 f087302052d8dcb77db00f909d17001075e87faa844e25dfb48e068cc44d70a5c096de7e0064a92e31560af16134a6a883ae14e6d72939f28c6446bbaa1979a2
SSDEEP 49152:dJQVC3rY5iL9T4TA5cokt1kNS9wSwPpAr8KXUR9iA+ZULaWZJFrQbU2KpEvl53DB:7EWmuP7huL
MD5 SHA1 SHA512 SSDEEP

qp/dumper_presets/blacklist_tables.txt

SHA256 0d1509c125f5dab5fd13230a5b8c4bf2f13450394505f8b4d4488b68f23e7be6
MD5 bb00dc3a4eea4ed9edd140471f089f08
SHA1 96079b05c237531297cf23a113c269d11d4e986a
SHA512 c8ffeeef730648213378472199eb222f4b00153b67870afea2d49d563825d98da46fa119af60520e957643e46a614525fc6bf565af7a5a46ab8cd1efab5822a8
MD5 SHA1 SHA512

qp/dumper_presets/target_rules.txt

SHA256 b06fb98f9c2c61318679d93550625a6eb42ff85cac527000e4990cbe4e19c5b1
MD5 ddc29fa898a5fe33808462bcc42ad1f4
SHA1 6e6cb4387abef715710e554920965bf29bb7fbe1
SHA512 80cfbc6057517914d75c4ea267b43f0a54b87fb52ac482a1d54f8312eadd00839f86ee6b039ac871bcb37903b3eb4df1936d681f5e3467ce1ce7c252a61c99c6
MD5 SHA1 SHA512

qp/qparser-2.4.5.exe

SHA256 e7db95c97a5d45787cc3e40cbcb93b748fefc65bc14e162c746e37f979861729
MD5 b16e9097fc7d3af8ebfcfce7aba0a42d
SHA1 2af3c8408b8445fe81d9a7c8d7cc8e8a05bf80f5
SHA512 53a7a2c276fbc5159231c162eb863504448515f1a078832b81f1bffeedb1c82932810b66748fd4111d1b8fb866622a5cc63e79e497227b611c90886ba45d3f3b
SSDEEP 96:tr+ulojsBwJG8YqVcqHL/GSrrLc1VhrJuzeK:tyoasBwJG8nVjaSeVhrJgeK
MD5 SHA1 SHA512 SSDEEP

polyglot

qp/qparser-2.4.5a.exe

SHA256 758181cf11306fba67e159f49142bbce6413551493168d10e33269414c2ca467
MD5 bef79cb8f8cd3c1cb82569c504c8876f
SHA1 6d72ed3eab9c33a06d70fa6fa7167f9d090ad28e
SHA512 28ae9106f2befa9167f7eda32a83d7f4e6fff1ebf0b6d6c07b7f86a196c3e2b91354b16ac4625bb02318e29869a7f4df8eb22bcad6aad5bd7702e105bdf7ed1b
SSDEEP 98304:EFfIMaC8r7Cjc1M9Jt7gPTP2yMKcHkmwRjO2z4YVp:BMaC+g+Ek3Hf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Neshta payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

32996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

qp/result/24-08-2025/result_hgci_filtered.txt

SHA256 8caea260c9886c8e342a7c502db7116c53c09f532952734da83ae038a8f00ee1
MD5 ab4f0a668ee770d5349766ae860c053e
SHA1 6ce8159a8c773f60bae7f6c9b77812b6af0fdc95
SHA512 e008e1ab15235559a748fff953a442e35fe89ffcb9d93a38321a5ca78bcd5a4eafd64e651bc33b753ea9d0e043739231826d6c6258fc6cb357188c001a739dd5
SSDEEP 196608:7/Z8cV0k+bZg2g8WJ9QcZwuwrLa9yb35bdtdq2mZ+B48NXpOFLkRkFZg1Wsxxhhl:e
MD5 SHA1 SHA512 SSDEEP

DiamondFox payload

Detects DiamondFox payload in file/memory.

infostealer

qp/result/24-08-2025/result_hgyt_extracted_params.txt

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

qp/result/24-08-2025/result_keyn_filtered.txt

SHA256 4dbdc10d046f5fe264e2adae8b39b331a582c4d8504524c4301956606212c110
MD5 4ec4fc4d9bc65f3dc91510fcdfd12aff
SHA1 bb92f5c57cfff0c0d04e84ec4718ab5473e0a70b
SHA512 018bcc561f5ab2b1e3b79e4cda6844e6c2bfce95fbb985fe3283aa9e4f5a8bcde06279fa4ba3800b45c8741e8d3dbe66ec276a2948d91b9687681e295257db34
SSDEEP 98304:zVwAFwvKtvI0HufnmzLGHuor11UMs03uVQpdw5VUsO:5wIHI0OfOLGXr11Ut0eVQpjl
MD5 SHA1 SHA512 SSDEEP

qp/result/24-08-2025/result_wcge_extracted_params.txt

SHA256 bae6a2874c4dbc931be5c509d653528a3771c241566017dd59c9f6263208c017
MD5 391863d1c83df23917dc1983c8291bca
SHA1 5b84bfddb88600574c4457db3cb5d00be5b549d5
SHA512 6f861bbe669090db8db57fed62f6537bb556ab4a124a641d996f213b42b2f7b455685cb943a4e5fb36ca7ae447a8de1d4ea2f1ed0f1af891de8190c4c729ab31
MD5 SHA1 SHA512

qp/result/25-08-2025/result_fpkk_vuln.txt

SHA256 b313d2945a85fe47598eb1bb0932e54069714628a8613d2fddc295644aa998e3
MD5 e19f26e609961bf9cf0e16fe90fd88e9
SHA1 45de057cc96a6b5d5171b52a2f33c93f7d168b35
SHA512 3ac22559f8433ae85d4418c70491ad763e05ffe3c21768aaf90503e4c05cf41545d197120b775e3f348d49556364a158e30871bf6e545f796e2b9dea55a8fbbe
SSDEEP 1536:tN5wm7iWUM3ZUltRNm2rjxKtHX7Kb5xCAO:tNu+iDBm2r1GHGb5q
MD5 SHA1 SHA512 SSDEEP

qp/result/25-08-2025/result_gknm_vuln.txt

SHA256 b034989650cbd24fbfc00736c6f63a564a0e82a41e9ff90336342d9fa69cdfca
MD5 3d0ff3133735223b4ea96f36f493d56d
SHA1 4c76858ef9953b11f5b44a3d8c5eaca8e5f66776
SHA512 f1d1b2aae0d3970519d1ea54a9b2678dcf5dc6253bfa0a4d2c532ee6fc30d59d26e85ed49ccae5ca528784ebf9efd060b240c137f54ee0436fcfb5ec0dc550ee
MD5 SHA1 SHA512

qp/result/25-08-2025/result_lakb_filtered.txt

SHA256 0a1390f03ee752d3473a57b2fcc01f2b01e64ff7a0a6e6a9ec68c3d8c2250ce4
MD5 5e5610019a0e551cb78624a1e5e11e18
SHA1 c6196255cc84128ff18880804b15bafddc8c5f6b
SHA512 29be230abf6dfe3f09f09015a0680e85fcad7ed1049cd82a4f014aca8f46847f6b91c1ad029fca193f22ae1c2b0c6cbf2cf6e56c0d4356be34a863bd9bfcd049
SSDEEP 49152:ZGoiRdUJGNhx1r+mDx6nt8Ni1SFP47E8hLFohvqZtBCDGt:M5g2Nbq9
MD5 SHA1 SHA512 SSDEEP

qp/result/25-08-2025/result_nalg_vuln.txt

SHA256 c66a3bc49d7d5d8daed3745e94236b207f87eb2ec7ef3e1a2c6acffbbe5074b5
MD5 50d775c55e4e98e26f446365a8dbe99c
SHA1 398bfc696c4c995f075d6ed742dc73f228929bca
SHA512 39f3dab8c9e10afddc9826f17972ac106dcc758841b4b56e16e63b86266b0961a488c65b29c25379a8191e8081a6800e0c56c3aa4dc99def13c9ee2ef1647adb
SSDEEP 768:tMISN+wSaaiQ1dqb7O3ESfa54odmSn2AgGVJiXEGjksm2S:tvDwSdh+by3BlPEGDm2S
MD5 SHA1 SHA512 SSDEEP

qp/result/25-08-2025/result_zhcn_vuln.txt

SHA256 b034989650cbd24fbfc00736c6f63a564a0e82a41e9ff90336342d9fa69cdfca
MD5 3d0ff3133735223b4ea96f36f493d56d
SHA1 4c76858ef9953b11f5b44a3d8c5eaca8e5f66776
SHA512 f1d1b2aae0d3970519d1ea54a9b2678dcf5dc6253bfa0a4d2c532ee6fc30d59d26e85ed49ccae5ca528784ebf9efd060b240c137f54ee0436fcfb5ec0dc550ee
MD5 SHA1 SHA512

qp/result/26-08-2025/result_buof_filtered.txt

SHA256 82ceb39350703989c819a8e9f3668c5bab8342edeb3b002ab151764f2b983b17
MD5 d83c18cdc3475489c4d76fd60f9cdf7e
SHA1 22219454b7f25c4efca086924e7dbaa2f86140dd
SHA512 e26418a15ea1f3e80cfb2adbd42eb1105ba86f33e7c6514f7cc1afff70730327c9a54f622c9ebf347f34d8041a098ce30eb84aea086c1cf33aaa43c62ef236a0
SSDEEP 49152:zHUtS9z8jLkizQIvsVTXd9UeNOV4b95eAEH2nHmv8CJ4Ra3oARpKFO+19/ltsTaU:RpzqmREAAusW0Lx/Ui4QtaS
MD5 SHA1 SHA512 SSDEEP

qp/result/26-08-2025/result_ctfn_filtered.txt

SHA256 28bf0e9b2c45b820fa246e334048414a65e52274e97f7756a9bd1bfa0237323d
MD5 def75fe2fbcafef79d442d280ef2e1a3
SHA1 ea8a4d280e361ec2f17c9ff055221335a7d51e1a
SHA512 6ba2882cf1ce015fad54934bd08fd6ccdebe4516d634e166389efe0aec6da649c5408db64bfbe98f19c6ad06bc942d68b3ba48ce784769753458295b3a01f7d7
SSDEEP 384:DR5LxgZCyGZ6gPRaThEvG0VbH2jMVoZvHGr/mP72GlWgLV:DR5FgZLGZtJ+uvXVbH2jVZvKOiGUgLV
MD5 SHA1 SHA512 SSDEEP

qp/result/26-08-2025/result_hymy_vuln.txt

SHA256 c1bf8d6e92ce9eb4f02a29a8c4b46297c2ba7439791b80114494094a5de72796
MD5 b9dcc0f61b27a1dea02c468e84895e75
SHA1 fde15f3be0ffc49497a8a71d76a1bdc8b762c5cc
SHA512 4875dfe16b697a951dd4112c292e866ae0cec690157e3b2b7f642689ae21032d8b9a1a9f56016aca4ad1121f6ebd3d3a8539a6250dd8f2befe2658ea0c745c2e
MD5 SHA1 SHA512

qp/result/26-08-2025/result_jeag_vuln.txt

SHA256 0acbe21ef4665067c4afade544d07a6abbc657bcc00c9e1dc3be8201179eab86
MD5 eb129dcad713048d4bbb14a3a008bdb6
SHA1 875629be3cbd82948a8abe422e00ddda66ff945a
SHA512 812f312ad792e3abf818a1c4c80619c3fe8009a7b997cdd86d573dcb6949feb5efa50110f0c4c7ef5b8cd837f05c0a27d67866696229c234674d46858e7b3ade
SSDEEP 192:2KPEzILak5VvMFyRsFxigFFzxRjJCDdHmqKMpdkHfSwxUOqwe3HTR0kYDzGsD42c:AzILaknM/njFxgXjo2OqfHONzGsb8
MD5 SHA1 SHA512 SSDEEP

qp/result/26-08-2025/result_jucr_filtered.txt

SHA256 ee560ec1d8b39fdff086a867ec8bb31c99292ebdbdbe53576a5b1e8980f2a044
MD5 052e323e72b9be4c8684a81f5cb807ec
SHA1 ea94f1fcda90ae97b91b0f4f1179dabf16bb0425
SHA512 2dd55fffbc0ea0cec62b6e3f9a52b8ef74615e66a6c793954572aa5c42607790015ae51df355f0657406d1d5b7debe30858d2531ff801dba11a286c1d3c88214
SSDEEP 12288:N6FdjQ0DeJMLasMBnSvz7yGBmBTPRhH7N:gXQ0aTsknSrPBmBTz7N
MD5 SHA1 SHA512 SSDEEP

qp/result/26-08-2025/result_kwzi_vuln.txt

SHA256 c1bf8d6e92ce9eb4f02a29a8c4b46297c2ba7439791b80114494094a5de72796
MD5 b9dcc0f61b27a1dea02c468e84895e75
SHA1 fde15f3be0ffc49497a8a71d76a1bdc8b762c5cc
SHA512 4875dfe16b697a951dd4112c292e866ae0cec690157e3b2b7f642689ae21032d8b9a1a9f56016aca4ad1121f6ebd3d3a8539a6250dd8f2befe2658ea0c745c2e
MD5 SHA1 SHA512

qp/result/26-08-2025/result_moho_extracted_params.txt

SHA256 f2e90b5c6cdb1db5bffa291c4b75d9f20c771dc79224d8d46dbe5c83e45ac2e9
MD5 11a5584206ff410cf03c7d488ce80877
SHA1 4599fed14962f78efad404bb4d31734a445cced2
SHA512 281b5267fb61321f79b079a8cb48b4a6bad296c17a167fe04f39c8dca0f03a4134602e297127377bdf2bd164d72828575498ee56eb0b0c82a414ccd099c202a4
MD5 SHA1 SHA512

qp/result/26-08-2025/result_pqfc_vuln.txt

SHA256 e88d24668c72ebcf5a338acd8cecc1e301f4b83f80e328e119137d1c3f5a15ee
MD5 88a2b568fae832245beccc5a374e5f5a
SHA1 890d2fd565f00b0472764d8f498015d4bf377d2a
SHA512 f416c475ba72696edf01d98ce5d7a7e24c75e92ac4580e4a19b100582fc09b0a0cec5842aa3c3b2fde6073663f87a83fc4cba7ce61865359c36d3b77bebdd154
SSDEEP 192:2KPEzIbk519vMFyRsFxigFFzGILCDMiHFqgMpwfIfS2x5qwTe3HTGzGsDO2iFtqO:AzIbkTRM/njFzG25n/qwIHKzGsGHX
MD5 SHA1 SHA512 SSDEEP

qp/result/26-08-2025/result_ujsr_filtered.txt

SHA256 d1c77283d7cc28b29761f5724833ad03ada29ec7b0e8516170224ae9848e3efd
MD5 9ecd23071872587c8968e5e12b9c7558
SHA1 bcd5c9e38d7341bc4acde6c6a250b8653dbfac86
SHA512 75f040deeda29463623d9343b940e0157f0a9dbfb686c87cf45a4cc470eb7b727d4649a41ff376db9762b851abbf2eab9353b29f42367970add8fd8fd5919eab
SSDEEP 49152:/V6tUvVXh/NNQXdReBosUPxjL/WbPEUJ2zRanoDxI/PLZAT7lRjx63QMHRgbTmGW:V6QxEw
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

qp.rar

qp/anti_public.db

qp/dumper_presets/blacklist_tables.txt

qp/dumper_presets/target_rules.txt

qp/qparser-2.4.5.exe

qp/qparser-2.4.5a.exe

generic

qp/result/24-08-2025/result_hgci_filtered.txt

qp/result/24-08-2025/result_hgyt_extracted_params.txt

qp/result/24-08-2025/result_keyn_filtered.txt

qp/result/24-08-2025/result_wcge_extracted_params.txt

qp/result/25-08-2025/result_fpkk_vuln.txt

qp/result/25-08-2025/result_gknm_vuln.txt

qp/result/25-08-2025/result_lakb_filtered.txt

qp/result/25-08-2025/result_nalg_vuln.txt

qp/result/25-08-2025/result_zhcn_vuln.txt

qp/result/26-08-2025/result_buof_filtered.txt

qp/result/26-08-2025/result_ctfn_filtered.txt

qp/result/26-08-2025/result_hymy_vuln.txt

qp/result/26-08-2025/result_jeag_vuln.txt

qp/result/26-08-2025/result_jucr_filtered.txt

qp/result/26-08-2025/result_kwzi_vuln.txt

qp/result/26-08-2025/result_moho_extracted_params.txt

qp/result/26-08-2025/result_pqfc_vuln.txt

qp/result/26-08-2025/result_ujsr_filtered.txt