MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80a49f6d176bd323b07bd6df4880a39699522bea37e58db72da3d6891c27e3d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 8

Intelligence 8 IOCs YARA 10 File information Comments

SHA256 hash:	80a49f6d176bd323b07bd6df4880a39699522bea37e58db72da3d6891c27e3d7
SHA3-384 hash:	3b46b4022c93ddade73d2af56695fe0d5d632ea4d19627d8da17427c286e497dc308b0438da3f546c50823f739e04c5c
SHA1 hash:	4a3c0a42ae36b5f7eae5df2d0d0d2211936209b4
MD5 hash:	0db9585c3bdfbffa60c5681683c22123
humanhash:	harry-enemy-twelve-thirteen
File name:	order SL2024-01.pdf.gz
Download:	download sample
Signature	Neshta Create hunting rule
File size:	759'612 bytes
First seen:	2024-06-19 07:07:02 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	12288:9rUcdbHd2d1w9y/AOK1AomxRs5UuMbyTj4CqqQTv5lHl8A4Ml8nFfNpVj:VUOAd29XOKAomXs5UuMeTjQXZJ8r
TLSH	T131F4234F388D781F6EBAC30A92941B78CB9085FD5705474D7B48FAE2949117F8A8F09E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	gz Neshta

cocaman

Malicious email (T1566.001)
From: "Saho Hasegawa <hasegawa@sincere-inc.co.jp>" (likely spoofed)
Received: "from sincere-inc.co.jp (unknown [94.156.8.144]) "
Date: "18 Jun 2024 14:35:42 -0700"
Subject: "New Order SL2024-01. SINCERE"
Attachment: "order SL2024-01.pdf.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	order SL2024-01.exe
File size:	1'263'616 bytes
SHA256 hash:	12afbeae36c86ffa1781c6faac9cd3b460fe5835c55b901e7ec28e39df418d5e
MD5 hash:	827d17ea8908eee608affcbf9a41a4a8
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

autoit epmicrosoft_visual_cc fingerprint keylogger lolbin masquerade microsoft_visual_cc packed redcap shell32

Link:

https://www.filescan.io/uploads/6672839cef9fdf64aa6cb56e/reports/cc7b0d4f-4290-44a4-bc61-3bb6bfa22650/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/80a49f6d176bd323b07bd6df4880a39699522bea37e58db72da3d6891c27e3d7

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/80a49f6d176bd323b07bd6df4880a39699522bea37e58db72da3d6891c27e3d7/

Threat name:

Script-AutoIt.Trojan.Strab

Status:

Malicious

First seen:

2024-06-18 13:54:46 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qcsj63ixnpjshmd323purafds2mvek7kg7sy3nznuplishbh4plq._file

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta persistence spyware

Link:

https://tria.ge/reports/240619-ld69zasdjq/

Behaviour

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Drops file in Windows directory

AutoIT Executable

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Neshta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/80a49f6d176bd323b07bd6df4880a39699522bea37e58db72da3d6891c27e3d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator