MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a20f9a7f06259d2d59c7670f84f206eac129e3a85f4df0c444e0a3dabe6cc84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 2


Intelligence 2 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a20f9a7f06259d2d59c7670f84f206eac129e3a85f4df0c444e0a3dabe6cc84
SHA3-384 hash: 5d89f84351d92751a1f8f8ec4b4222a62da5bbacd912a92193f1450f93204a3006ac9145960b305d2d5dce47af173d97
SHA1 hash: e45d493f92ae01abbf91e3f6e7d7155b8789d2b1
MD5 hash: 1502ae163e41a238aabbec9cd9170247
humanhash: august-queen-red-east
File name:6a20f9a7f06259d2d59c7670f84f206eac129e3a85f4df0c444e0a3dabe6cc84
Download: download sample
Signature Neshta
Create hunting rule
File size:109'056 bytes
First seen:2020-11-07 20:02:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f4693fc0c511135129493f2161d1e86 (253 x Neshta, 15 x Formbook, 14 x AgentTesla)
ssdeep 3072:U9qq94bUCPuH1Gv10ocLjf/Xn8AYYpHFtnP:6cmH1G3cnNhFtP
Threatray 7 similar samples on MalwareBazaar
TLSH 99B39D26F49180B1E86305B55B46F2FF8536F632981659FAF7DC4C0EDBA7EA0790C206
Reporter seifreed
Tags:Neshta

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Virus.Neshta-7101689-0
Create hunting rule

Win.Trojan.Neshta-160
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file in the Windows directory
Modifying an executable file
Creating a file in the Program Files subdirectories
Creating a file
Enabling autorun with the shell\open\command registry branches
Infecting executable files
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a20f9a7f06259d2d59c7670f84f206eac129e3a85f4df0c444e0a3dabe6cc84/
Gathering data
Verdict:
suspicious
Similar samples:
0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
Neshta
1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb
Neshta
52055c63e2a063c0d4489918ff3bc7e63c9ff94bb56ad95003d8594d01bb81d2
Neshta
5261874485f9fe16a78a558734e8652f93db1d544f3be331e7f6adc06f43ee98
Neshta
5493074b52dab5b859bb7bf54fdccf45ac005c3f9a2adafc52ac42891ca84793
Neshta
8ccce2a5d01211e5db0bcc8721dbea06422c5f3133466e4945e4d301d44df3b2
Neshta
e1614a878888eddb3296e856dc5f4e63a926b9e4c899cf09da12a8f477ace4cf
Neshta
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/201108-thy6pmq1zn/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies system executable filetype association
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Netsha_Mar20_1
Create hunting rule
Author:Florian Roth
Description:Detects Netsha malware
Reference:Internal Research
Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments