MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56fd163108e6e2a9e2f7cfd15898f61d5b8d435ed839d1e29b70c040998eedcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56fd163108e6e2a9e2f7cfd15898f61d5b8d435ed839d1e29b70c040998eedcf
SHA3-384 hash: 4ffb83b3620c6d9226404256ca1be9db272c595b59173b41b85500d61ca36a88d733af2410921a4a2c0dad94d01f53a8
SHA1 hash: 4caeeacf2e4dcac911f64a20b00388f96e9adc7e
MD5 hash: 98ec95d07881fe20943c648fc17a4884
humanhash: cold-cardinal-bluebird-hot
File name:Dekont_20220926155607 pdf.exe
Download: download sample
Signature Neshta
Create hunting rule
File size:11'776 bytes
First seen:2022-09-26 08:27:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'749 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 192:yMZ3k3osS0Otg03xoVjn9GprrrrrrrrrrrrrrrrrrrreKp:yMZ04s7OSaxoVwprrrrrrrrrrrrrrrrh
Threatray 1'007 similar samples on MalwareBazaar
TLSH T1BF3266C1B786C59BD5608C79AC6283D00B2D7D16FD627D7FB9C9B72F58115C808B26E0
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon a0a2a2a2a2a0a485 (2 x SnakeKeylogger, 1 x Neshta)
Reporter abuse_ch
Tags:exe geo Neshta TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
244
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/313502/
Detection(s):
SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633162e126a88abc7d2a1fa5/reports/8820be2c-3843-4e7c-91c5-9a099530037c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cc9d9144-ce00-4ead-90c3-b18b97280f1b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1077306
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected MSILDownloaderGeneric
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56fd163108e6e2a9e2f7cfd15898f61d5b8d435ed839d1e29b70c040998eedcf/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2022-09-26 06:25:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k36rmmii43rktyxxz7ivrghwdvny2q263a45dyu3odaebgmo5xhq._file
Verdict:
malicious
Similar samples:
17f2438a8bbd9ac5a40d6315ee68720395ff47a3a8c7d81175d9beff41476e18
Neshta
3dd3078924cd154c4543f6e47ede6d36fd676a500dc76b1a44c3484417ae9cbf
Neshta
51eaf57ae9fde2cb71b84897ddfd8d5c69bb0604dad100de6ce57f026f3cbada
Neshta
6657fc401ddcb3ffdbe0d45b7850f9a2bccef46d42469b825cd890557a351693
Neshta
806a765203bdd0a1e4c715bf6022dce830d04ae041ef978b3b2890b158a7e180
Neshta
8aa4295ba55d4375ddf998facfb0a7a95394cdae9c4eac0a0fbaccae4df717c6
Neshta
94c64f12afd02a13f709021efe6a3676f92ee6ea68ea91b67e476ba603c0b79b
Neshta
ba357be7f8b30e5ffbd88531d2c775280ac102ad0965e56bd5fc2d89dfac0f2f
Neshta
d1be2499de89be1f90b8fba3abbf20cfd30152c3ae10674152b2604ac86d76ac
Neshta
f15bf4c786172149ed0b9e57b08c695b01095b9167de714ea61768f021ae9ff0
Neshta
+ 997 additional samples on MalwareBazaar
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:neshta discovery persistence spyware
Link:
https://tria.ge/reports/220926-kcz9laaag7/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks computer location settings
Creates a large amount of network flows
Detect Neshta payload
Modifies system executable filetype association
Neshta
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/da2a1c2e-19a6-4da1-94b6-8df31c18cf41
Unpacked files
SH256 hash:
56fd163108e6e2a9e2f7cfd15898f61d5b8d435ed839d1e29b70c040998eedcf
MD5 hash:
98ec95d07881fe20943c648fc17a4884
SHA1 hash:
4caeeacf2e4dcac911f64a20b00388f96e9adc7e
Link:
https://www.unpac.me/results/a45d0940-1fa2-4e91-8193-c18bb8008610/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/56fd163108e6e2a9e2f7cfd15898f61d5b8d435ed839d1e29b70c040998eedcf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Discord_Attachments_URL
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/313502/

Comments