MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58f33976b1934ff2e471844d7a7ee4c6e4ab3edb8ca2a6b88c86795c3368cfeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58f33976b1934ff2e471844d7a7ee4c6e4ab3edb8ca2a6b88c86795c3368cfeb
SHA3-384 hash: da30bee6763e1b3c5187f5a058f24542fa3b2d71541bd3e0892ca5c36e8ce8347f6e39696f6e59a579012cc1b11cf22d
SHA1 hash: 033ed494fb597f1fcf602a1ebdad4f3eca96a519
MD5 hash: ba799e2cd16429d7ba1ffef2136a5aa1
humanhash: lithium-lion-nevada-friend
File name:58f33976b1934ff2e471844d7a7ee4c6e4ab3edb8ca2a6b88c86795c3368cfeb
Download: download sample
Signature Neshta
Create hunting rule
File size:41'472 bytes
First seen:2021-08-02 10:26:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f4693fc0c511135129493f2161d1e86 (253 x Neshta, 15 x Formbook, 14 x AgentTesla)
ssdeep 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
Threatray 103 similar samples on MalwareBazaar
TLSH T10A135B56F6E1C871D0201EFCCC1AD268D53B7A317D2A2AB2BAE51E4DDC7D3C2291C54A
dhash icon d11120081511864c (1 x Neshta, 1 x CobaltStrike)
Reporter JAMESWT_WT
Tags:exe Neshta

Intelligence

File Origin
# of uploads :
1
# of downloads :
300
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
58f33976b1934ff2e471844d7a7ee4c6e4ab3edb8ca2a6b88c86795c3368cfeb
Verdict:
Malicious activity
Analysis date:
2021-08-02 10:33:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/71207444-2b76-4f4d-8c64-f9ab1d02a811

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
neshta
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175770/
Detection(s):
Win.Trojan.Neshuta-1
Create hunting rule

PUA.Win.Packer.Pequake-4
Create hunting rule

Win.Virus.Neshta-7101689-0
Create hunting rule

Win.Trojan.Jadtre-5
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows directory
Modifying an executable file
Creating a file
Sending a UDP request
Creating a file in the %temp% directory
Enabling autorun with the shell\open\command registry branches
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Neshta
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3959882b-b802-4b3a-9403-f1422a879062
Result
Threat name:
Neshta
Create hunting rule
Detection:
malicious
Classification:
spre
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/825448
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Neshta
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58f33976b1934ff2e471844d7a7ee4c6e4ab3edb8ca2a6b88c86795c3368cfeb/
Threat name:
Win32.Virus.Neshta
Create hunting rule
Status:
Malicious
First seen:
2021-07-31 22:11:26 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
28 of 28 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
13d0b9cc42969b85ff7742d9976eeb409e4d662c28aeeb5f2092c93accd6b845
Neshta
412bcb0abe4197be23ae265308d96f9db0f0fd5f96ec0ac053d744d1565e80eb
Neshta
47af206f5b28365c01eb80fa135f1acb09f99ea37dd9c2ad23d5c7f359f29e0f
Neshta
4b9c39b0624ed5da7d8ffeb5b8de89562a0ba2db40e4899160fdd1e51efa63ea
Neshta
5d7566ee48f7c1525a1d0e5cf2e5463929d7ad9fe55519acec2a4fcb19507f7e
Neshta
70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005
Neshta
a47e72e6ebf467b28c35258a18733081d03e4701937d05d74b10a4bcc0029cb5
Neshta
b2ae47f62aa239fb6badfb8af83054c008e9c93d6fe1953732ec03029dc474ce
Neshta
e615a06c4539fc5fabedd46658fdc2ff534d0173f9043162f3809ef3002f0a2c
Neshta
fdec06df5406c4ce7396704a8160927a2bdceeac0bb111b702ec310498e9a5ba
Neshta
+ 93 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/210802-cdea6snm3x/
Behaviour
Modifies registry class
Drops file in Program Files directory
Drops file in Windows directory
Loads dropped DLL
Reads user/profile data of web browsers
Modifies system executable filetype association
Unpacked files
SH256 hash:
58f33976b1934ff2e471844d7a7ee4c6e4ab3edb8ca2a6b88c86795c3368cfeb
MD5 hash:
ba799e2cd16429d7ba1ffef2136a5aa1
SHA1 hash:
033ed494fb597f1fcf602a1ebdad4f3eca96a519
Detections:
win_neshta_auto
Create hunting rule
Link:
https://www.unpac.me/results/016a8300-0861-4b3b-b86f-5cf46ca386d6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58f33976b1934ff2e471844d7a7ee4c6e4ab3edb8ca2a6b88c86795c3368cfeb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175770/

Comments