MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b1949f624ae24ef9dcbf1543b10bfa591eee33e72bd50a5b562de993a0ab42a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b1949f624ae24ef9dcbf1543b10bfa591eee33e72bd50a5b562de993a0ab42a
SHA3-384 hash: efe0a76b0642c2a8721a3a6fab507e984c5a9994a640e193f46fa888d7f8ac98a31d0849c131822ab4eb24c66ede9bb5
SHA1 hash: 9b47f8b3f5e10ca67a6aa944f4de5bf6d622a949
MD5 hash: d276373be7d76a1f038774a143269b17
humanhash: juliet-seven-neptune-emma
File name:SKM_C335019110710.exe
Download: download sample
Signature Neshta
Create hunting rule
File size:672'768 bytes
First seen:2021-08-28 00:16:38 UTC
Last seen:2021-08-28 01:06:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f96272d7334ea5c5b0f297a4213e926 (2 x RemcosRAT, 1 x Neshta)
ssdeep 12288:Z+i50uK9LCFU3c7aaNip0zoIysLefr8ZRhp:0E69LP3c7HM0zofs6fri
Threatray 305 similar samples on MalwareBazaar
TLSH T1DEE47D767AA0487FC35A2BBD9C2F74A9B4117FA03D26F64523F43E841A383853819767
dhash icon 48958834524ae518 (2 x Formbook, 2 x RemcosRAT, 1 x Neshta)
Reporter GovCERT_CH
Tags:exe Neshta

Intelligence

File Origin
# of uploads :
2
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SKM_C335019110710.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-28 00:19:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/42b2a6f0-7714-4e0f-8df7-af47fc950a17

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182990/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Creating a file in the %temp% subdirectories
Launching cmd.exe command interpreter
Deleting a recently created file
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e1eb31c4-c3a6-4350-bbac-bcd5f9331dd6
Result
Threat name:
Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/840623
Signature
Allocates memory in foreign processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Execution from Suspicious Folder
Writes to foreign memory regions
Yara detected Neshta
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b1949f624ae24ef9dcbf1543b10bfa591eee33e72bd50a5b562de993a0ab42a/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-08-27 23:00:59 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmmut5revyso7hol6fkdwef7uwi65yz6ok6vbjnvmlpjsoqkwqva._file
Verdict:
malicious
Similar samples:
0f588cc0f351e5a7a82372fb978693bd088484d89d2219267a4fd7f7c52203d8
Neshta
35781f59dd0d4db4313b493ba0f80606f0f999c904e72a2dd76b0cb111678cde
Neshta
412bcb0abe4197be23ae265308d96f9db0f0fd5f96ec0ac053d744d1565e80eb
Neshta
563d0226f3ff043014f86d780778fc6bbae2193e46137271d586ca3d83da34af
Neshta
58f33976b1934ff2e471844d7a7ee4c6e4ab3edb8ca2a6b88c86795c3368cfeb
Neshta
a73f2d92c3d48bad18d6a33530cedee50fb1495030c752d406045c113eeabd0a
Neshta
a7c09392aa26962b20d2fc58398b6425ebd062187b2923fbbb7b1866523f1e26
Neshta
b2ae47f62aa239fb6badfb8af83054c008e9c93d6fe1953732ec03029dc474ce
Neshta
de544199796705d18dad9dcf238c7c96de3fc8c793057cad94e319527af9c7bd
Neshta
e1b0ef4dd27c829683569165d98c902a8ed2f2eaa95b1540c6430f5ea3be0b3f
Neshta
+ 295 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210828-wzh2nm5qcj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
4e1202f3e7e04b0b3ca1df164bf5381f24063c142317e774d4e5d88b2b3ac744
MD5 hash:
aa23dee2c34813d67fe9c67ec784782a
SHA1 hash:
10b2e7af7cb9d6f852e6d607875a8c9613538930
Link:
https://www.unpac.me/results/ab86c67a-3fea-4d7c-8c4d-f2a5a3cea170/
SH256 hash:
8b1949f624ae24ef9dcbf1543b10bfa591eee33e72bd50a5b562de993a0ab42a
MD5 hash:
d276373be7d76a1f038774a143269b17
SHA1 hash:
9b47f8b3f5e10ca67a6aa944f4de5bf6d622a949
Link:
https://www.unpac.me/results/ab86c67a-3fea-4d7c-8c4d-f2a5a3cea170/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8b1949f624ae/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.36
Link:
https://yomi.yoroi.company/submissions/8b1949f624ae24ef9dcbf1543b10bfa591eee33e72bd50a5b562de993a0ab42a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Neshta

Executable exe 8b1949f624ae24ef9dcbf1543b10bfa591eee33e72bd50a5b562de993a0ab42a

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/182990/

Comments