MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005
SHA3-384 hash: 7dafc61e1ea3fe773fc40033274a7dedcfe369e9fa8669bf80cd489817bca5ffa7bc8053abce94d3c4ef36ae1c4677a2
SHA1 hash: b1ef1b47cb790ee88866d31bb09929a516e36caf
MD5 hash: bf4ca3ef810bbc866015723e09cdfb7b
humanhash: nevada-vermont-apart-alaska
File name:bf4ca3ef810bbc866015723e09cdfb7b.exe
Download: download sample
Signature Neshta
Create hunting rule
File size:487'424 bytes
First seen:2021-07-09 18:30:07 UTC
Last seen:2021-07-09 19:47:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:oW8uCJjuCn6iQUB8CHPku8TvKNK6KSKPbmsrqc/4N1uT8Xh2SomYmjtvpl0:oW2spxjmpaC0T8Xhjjt
Threatray 86 similar samples on MalwareBazaar
TLSH T158A4029166B4D53ED2AB49F7CE655F906673A31BF8A452C471FE82A4C387FC0B803294
Reporter abuse_ch
Tags:exe Neshta

Intelligence

File Origin
# of uploads :
2
# of downloads :
170
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bf4ca3ef810bbc866015723e09cdfb7b.exe
Verdict:
Malicious activity
Analysis date:
2021-07-09 18:32:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/02c8c53c-9cba-4940-a9ee-1980f00f1dfe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Neshta
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170725/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.919.7666.3244.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Neshta
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0188f2c7-786d-4937-a13b-a7d06c5e825e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spre.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/814172
Signature
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-09 09:20:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
13d0b9cc42969b85ff7742d9976eeb409e4d662c28aeeb5f2092c93accd6b845
Neshta
1aae387dce8782d2f58887aa73dd970e51656c72ada983fb040989656a6dc47e
Neshta
35781f59dd0d4db4313b493ba0f80606f0f999c904e72a2dd76b0cb111678cde
Neshta
412bcb0abe4197be23ae265308d96f9db0f0fd5f96ec0ac053d744d1565e80eb
Neshta
4b9c39b0624ed5da7d8ffeb5b8de89562a0ba2db40e4899160fdd1e51efa63ea
Neshta
4ba041292881b73bc2cf7842f17b64eeca555b209577f5ea842fbeaa30f05ea0
Neshta
563d0226f3ff043014f86d780778fc6bbae2193e46137271d586ca3d83da34af
Neshta
b2ae47f62aa239fb6badfb8af83054c008e9c93d6fe1953732ec03029dc474ce
Neshta
d32f34638ac6c33cd00dc1c394f9479e5abb88dfe66f5447e2b491bd8d15fea7
Neshta
e82473f02711056cbcda98d22a858d95c6cf574c17ee77ea62db86e405ff6e77
Neshta
+ 76 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/210709-dplxbpw8y2/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Modifies system executable filetype association
Unpacked files
SH256 hash:
0dc85bac9d25e4b01f641ca79ab4ec27e9c832fa7641a270bd379f2a679c0c6b
MD5 hash:
75f5605d92de3131e682c331bf150d8f
SHA1 hash:
e2a1aa2f9041325088bbd1fc6273a37fcd5f8e38
Link:
https://www.unpac.me/results/69ddda83-47c2-4831-b6f7-64c6150a0721/
SH256 hash:
4222c52e5634fa246ee8b21dc1793a6513dd58be5364278ed4a0a7ca3893c82f
MD5 hash:
272c19571c4a30d99fc656f6e15e439d
SHA1 hash:
798fb1cf362a9eef19ebd5c38914041ec235ac2b
Link:
https://www.unpac.me/results/69ddda83-47c2-4831-b6f7-64c6150a0721/
SH256 hash:
601988fc7daae671a0a27b38d9212e6a8fdfd9110dd099153fcf80f826a2d2e1
MD5 hash:
3024a3be79d03af30cb5ef949b1c1d09
SHA1 hash:
2628411c7216202f7d54c8f64a596cc46e465f3f
Detections:
win_neshta_auto
Create hunting rule
Link:
https://www.unpac.me/results/69ddda83-47c2-4831-b6f7-64c6150a0721/
Parent samples :
70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005
a73f2d92c3d48bad18d6a33530cedee50fb1495030c752d406045c113eeabd0a
0f588cc0f351e5a7a82372fb978693bd088484d89d2219267a4fd7f7c52203d8
a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec
37788378096171de3632795ccedd7562dc5f514497394dcdb9fbbea8960cce6f
SH256 hash:
70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005
MD5 hash:
bf4ca3ef810bbc866015723e09cdfb7b
SHA1 hash:
b1ef1b47cb790ee88866d31bb09929a516e36caf
Link:
https://www.unpac.me/results/69ddda83-47c2-4831-b6f7-64c6150a0721/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.83
Link:
https://yomi.yoroi.company/submissions/70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:buerloader_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Neshta

Executable exe 70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1430903/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/170725/

Comments