MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43a4ccbc49a375bf9ee5bd085412f9e81bd4e9aba05db7e357dd95e04613a70b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43a4ccbc49a375bf9ee5bd085412f9e81bd4e9aba05db7e357dd95e04613a70b
SHA3-384 hash: 81b9ebf50b97f295fa03b111daccaa5faed608c3ca174c9589aed5d71db67107531c5c200666461d6e0744d2c6701f98
SHA1 hash: 394c41cee4b594ea8ba8d0fd6b686721a52e61ad
MD5 hash: 5e6fd71b7a515479b2e5e77bc7ea22f8
humanhash: quiet-network-ceiling-apart
File name:svchost.exe
Download: download sample
Signature Neshta
Create hunting rule
File size:996'864 bytes
First seen:2020-05-21 11:15:58 UTC
Last seen:2020-05-21 12:24:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:Aukx3gKIoADALW7SyoyfWeU/OPFVNm1bOnVVnrQSBjfEpb4vkU:agKBAcmoyeUdkOnVFNERj
Threatray 84 similar samples on MalwareBazaar
TLSH 7E2523607ABDBBA2E68D0B742A34798053B77B1F1532DB4C194071CE9932F818B92F57
Reporter James_inthe_box
Tags:exe Neshta

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.49161.32667.10509.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 10:57:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
Neshta
0a5e60319a443610bd184d1d0140036332d56430e32976e79c6aeec24be7d701
Neshta
147c11e1c610932b1c2e0413ff84b3e6db9b4e4da9a62294fae5e25aac590013
Neshta
30906d9b754f0687ae3970b83f619a22cf338a478ef6a4165a8f7e378903f616
Neshta
5d39d8514724cc23cd2f0265a46345bd10118e699516f3075b376def2004d5fb
Neshta
6cdda681496328866d2578f5134c0f87be9918419d6ad31f2e8a7b1b479f7a87
Neshta
b54934cb8e1ff68d2c4306e5a6eb0f9e649ad1680960253c0cfa0c35a6c4d313
Neshta
c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9
Neshta
d6634157030fbc5aa6d88565981868dcacedfd91b8031ab0e2e8dd1a3f1b1c16
Neshta
e1614a878888eddb3296e856dc5f4e63a926b9e4c899cf09da12a8f477ace4cf
Neshta
+ 74 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/201109-d3bjgbafkx/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Modifies system executable filetype association
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments