MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716
SHA3-384 hash: fe0d593cffdab3271d9fe518fe7bf6881d3e2f7f84a6ca7ebea509812361f2b90c580e46aedac08a0c13cc3e9ab8eb05
SHA1 hash: a2559089ca598289ad964bb3aa63456c0ab8b4fd
MD5 hash: 97d2766b203cad5490aeae4049823b5c
humanhash: zebra-wolfram-triple-floor
File name:CARPETA_.EXE
Download: download sample
Signature Neshta
Create hunting rule
File size:854'016 bytes
First seen:2022-11-25 07:33:42 UTC
Last seen:2022-11-25 09:05:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f4693fc0c511135129493f2161d1e86 (250 x Neshta, 15 x Formbook, 14 x AgentTesla)
ssdeep 12288:Ly2OoPnK3jbgtwPi5CdZV7e8M4iULTXHYHmBE6mHtP38M:Qa/
Threatray 408 similar samples on MalwareBazaar
TLSH T11805205B38AA410DF6615D668FBCF172C55EEAF1197A1CB75DF3090A1012AF08B2DB23
TrID 89.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
3.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
1.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
File icon (PE):PE icon
dhash icon 30b2c4c8c8c4b030 (53 x Formbook, 41 x RemcosRAT, 20 x AgentTesla)
Reporter lowmal3
Tags:exe Neshta

Intelligence

File Origin
# of uploads :
3
# of downloads :
194
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CARPETA_.EXE
Verdict:
Malicious activity
Analysis date:
2022-11-25 07:48:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a587da00-5c0d-4271-add6-ea7cad370032

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Neshta
Create hunting rule
Link:
https://www.capesandbox.com/analysis/338343/
Detection(s):
Win.Trojan.Neshuta-1
Create hunting rule

PUA.Win.Packer.Pequake-4
Create hunting rule

Win.Virus.Neshta-7101689-0
Create hunting rule

Win.Trojan.Jadtre-5
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a file in the Windows directory
Creating a process from a recently created file
Modifying an executable file
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the Program Files subdirectories
Reading critical registry keys
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Enabling autorun with the shell\open\command registry branches
Stealing user critical data
Infecting executable files
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
neshta overlay shell32.dll
Link:
https://www.filescan.io/uploads/63806feb94f9bac087b34aba/reports/36554fcd-7ec6-424f-ada2-d985767a7370/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8a821ebe-8cad-4ec9-9a16-dbce707d6c2b
Result
Threat name:
AgentTesla, Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1120984
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected Neshta
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 753701 Sample: CARPETA_.EXE.exe Startdate: 25/11/2022 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for dropped file 2->43 45 9 other signatures 2->45 7 CARPETA_.EXE.exe 4 2->7         started        process3 file4 19 C:\Windows\svchost.com, PE32 7->19 dropped 21 C:\Users\user\AppData\Local\...\setup.exe, PE32 7->21 dropped 23 C:\Users\user\AppData\...\CARPETA_.EXE.exe, PE32 7->23 dropped 25 111 other malicious files 7->25 dropped 47 Creates an undocumented autostart registry key 7->47 49 Drops PE files with a suspicious file extension 7->49 51 Drops executable to a common third party application directory 7->51 53 Infects executable files (exe, dll, sys, html) 7->53 11 CARPETA_.EXE.exe 1 7->11         started        signatures5 process6 file7 27 C:\Users\user\...\CARPETA_.EXE.exe.log, CSV 11->27 dropped 55 Multi AV Scanner detection for dropped file 11->55 57 Writes to foreign memory regions 11->57 59 Allocates memory in foreign processes 11->59 61 Injects a PE file into a foreign processes 11->61 15 RegSvcs.exe 15 2 11->15         started        signatures8 process9 dnsIp10 29 api.telegram.org 149.154.167.220, 443, 49712 TELEGRAMRU United Kingdom 15->29 31 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->31 33 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->33 35 Tries to steal Mail credentials (via file / registry access) 15->35 37 3 other signatures 15->37 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716/
Threat name:
Win32.Virus.Neshta
Create hunting rule
Status:
Malicious
First seen:
2022-11-25 07:34:11 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
26 of 26 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gh46c6gcafndmtvcanohp2zh6g2aczlereapqjeulvki5e4ik4la._file
Verdict:
malicious
Similar samples:
2cf1affaddac715171d5be89d0c2bfaa3470608efdc12940967fc22fcffde54f
Neshta
6eae5f256537af00c1f53ee711d0bdd9ff1e9ccf771234f74c9fc58bfb63c8fa
Neshta
8c7068ecf9168d899f1e67971f0f20b590ece3c4e60d45bc0a90100eb111868a
Neshta
aae66e4930de3e86e7a4095dbba08680278f96f570a0d116e4616c12492a3073
Neshta
b50f7c365160c6134ce71e97e646d8245761687aa431a31a12423daf6cf33012
Neshta
ce87832b753df5480849c61df4e05bfd2bfbd72af88ad52093a54555f3d96f0e
Neshta
d5f162d4ab50a806c77d3462307ddaefb30135bb6a8ecbe75afc253a2c3cbd2c
Neshta
dc48e95839bcfd343c62e0a574a94e9640b8463e9c5c29bf04e7423135307994
Neshta
+ 398 additional samples on MalwareBazaar
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:neshta collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/221125-jd4gzabc37/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Modifies system executable filetype association
Neshta
Malware Config
C2 Extraction:
https://api.telegram.org/bot5678941731:AAHuT6ry1HeTpvo1csjgif_TAWF-WtH0QZk/
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/cbe6c3f8-abe8-4403-87d0-f7dbe5044993
Unpacked files
SH256 hash:
31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716
MD5 hash:
97d2766b203cad5490aeae4049823b5c
SHA1 hash:
a2559089ca598289ad964bb3aa63456c0ab8b4fd
Detections:
win_neshta_g0
Create hunting rule
Link:
https://www.unpac.me/results/7ed95776-4425-4b23-bd7a-7fd47bb6a860/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Neshta
Create hunting rule
Author:ditekSHen
Description:Detects Neshta
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Neshta

Executable exe 31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/338343/

Comments