MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5482f30f4cd3f124c272a13129c770cf944090ae9ef6e1e6a82a2d2bd745a6a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments

SHA256 hash:	5482f30f4cd3f124c272a13129c770cf944090ae9ef6e1e6a82a2d2bd745a6a7
SHA3-384 hash:	9913603af7041ceae9d8a4787ff727dae1b5e6bfcde8e6f9b50989fd7c0424e3d9782a09a2ed8f3eb63ec13cff1d730f
SHA1 hash:	90a20ff9a08166bd3c4b0a509e6f6d3f068334e9
MD5 hash:	c3f86895a1acfd35accdb6cc383dd35d
humanhash:	hydrogen-kilo-maryland-blossom
File name:	PO 42050 EXP 1423.rar
Download:	download sample
Signature	Neshta Create hunting rule
File size:	729'487 bytes
First seen:	2024-06-26 17:22:52 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:Qn3mm/KL6RjUSG2ahIyb9v+PGsUFi6GFufnJrjqRou02hsedkrtkm40NnsngLsxG:QWmVRjCXhIyb9v+PzU72O5UVerThNZIy
TLSH	T13DF423F0397935C218A141CAD2A2F09FAD93BD32424D9583AAB5A111E6D5FDB40CDF73
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	Neshta rar

cocaman

Malicious email (T1566.001)
From: "Thamyres Wesseley <export3@metvisa.com.br>" (likely spoofed)
Received: "from metvisa.com.br (unknown [51.83.250.117]) "
Date: "26 Jun 2024 10:21:56 -0700"
Subject: "RE: EXPORT - PO 42050 / EXP 1423"
Attachment: "PO 42050 EXP 1423.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO 42050 EXP 1423.exe
File size:	754'688 bytes
SHA256 hash:	6eb16df08e9ce41a8c5355c19817741c79386a93c402ffdbbffb5e221e609ab6
MD5 hash:	ae06766ec1be8ae093bbd938c195986d
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Rogue.0hr.20240627-0632.UNOFFICIAL

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

AutoIt lolbin microsoft_visual_cc packed packed redcap shell32 upx

Link:

https://www.filescan.io/uploads/667c4e79910ce98966fad736/reports/f7db467c-5d28-4e73-a125-d1321f716e82/overview

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/5482f30f4cd3f124c272a13129c770cf944090ae9ef6e1e6a82a2d2bd745a6a7

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5482f30f4cd3f124c272a13129c770cf944090ae9ef6e1e6a82a2d2bd745a6a7/

Threat name:

Script-AutoIt.Trojan.Zmutzy

Status:

Malicious

First seen:

2024-06-26 15:57:17 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ksbpgd2m2pysjqtsueystr3qz6kebefot33odzvifiwsxv2fu2tq._file

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta persistence spyware upx

Link:

https://tria.ge/reports/240626-xlxw2s1cjl/

Behaviour

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Drops file in Windows directory

AutoIT Executable

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

UPX packed file

Neshta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5482f30f4cd3f124c272a13129c770cf944090ae9ef6e1e6a82a2d2bd745a6a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator