MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 7


Intelligence 7 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19
SHA3-384 hash: 346939fb2988414c6caa37c7a745568b83d54e80cd75bfaad4cb140df45badd1ad1df174dd4b76567d5cbcab44052943
SHA1 hash: 72134b608cff3a830b3a468ce166a65ae1e5d152
MD5 hash: 8bbb3c9c479caf5639b1553b05fc3de8
humanhash: lion-william-speaker-arizona
File name:SOA of March.zip
Download: download sample
Signature Neshta
Create hunting rule
File size:696'156 bytes
First seen:2024-04-16 09:01:43 UTC
Last seen:2024-04-18 20:35:02 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:4otWvEDeHDpE50FNOtCyMZzCx5mXLbNEqGFTHrXWawhA59R7tqjiSqXnAbaZRG:4oJDYDq5mQtu1CxcXLbiqwrWnS9RBqjx
TLSH T1BCE433BF8C027655F5AC2652782ECCEF3C6BC6A233CC66BD419F5A5304F9A54D6C6028
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:Neshta zip


Avatar
cocaman
Malicious email (T1566.001)
From: "xuyqc@angelyeast.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.116]) "
Date: "16 Apr 2024 11:00:48 +0200"
Subject: "SOA of March, please check "
Attachment: "SOA of March.zip"

Intelligence

File Origin
# of uploads :
5
# of downloads :
162
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:SOA of March.exe
File size:745'984 bytes
SHA256 hash: 75854947a6a21c6fdacee3b080ad9f9c8c86546b54410a968d6f09c23e5d00c9
MD5 hash: 2f8cf1eacce33f87429c022d57a1ebea
MIME type:application/x-dosexec
Signature Neshta
Vendor Threat Intelligence
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19/results/dashboard
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-04-16 06:08:13 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pk6bxd5ios2eatest6zin2gzwffeghsw4sw6cobthehb7hr3v4mq._file
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:neshta persistence spyware stealer
Link:
https://tria.ge/reports/240416-myek5aad6y/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks computer location settings
Modifies system executable filetype association
Reads user/profile data of web browsers
Detect Neshta payload
Neshta
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:MALWARE_Win_Neshta
Create hunting rule
Author:ditekSHen
Description:Detects Neshta
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Neshta malware
Reference:Internal Research
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:neshta_v1
Create hunting rule
Author:RandomMalware
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Virus_Neshta_2a5a14c8
Create hunting rule
Author:Elastic Security
Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Neshta

zip 7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19

(this sample)

Neshta

Executable exe 75854947a6a21c6fdacee3b080ad9f9c8c86546b54410a968d6f09c23e5d00c9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75854947a6a21c6fdacee3b080ad9f9c8c86546b54410a968d6f09c23e5d00c9
  
Dropping
Neshta
  
Dropping
MD5 2f8cf1eacce33f87429c022d57a1ebea

Comments