MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec
SHA3-384 hash: aeb2333a2885d2ce8929185b992b8f3b4aaca94a05442a5c7ecade2b07bf2224063b1b312bfe2adf55750641d237efd5
SHA1 hash: 07eb1aea9e88b5edb608bc2fe66da0fc9199f3bd
MD5 hash: 9cdeb7a57e0b78f5a7b7d79e557d3dfe
humanhash: orange-snake-grey-helium
File name:PO#6018634905996.exe
Download: download sample
Signature Neshta
Create hunting rule
File size:642'560 bytes
First seen:2021-11-18 06:53:41 UTC
Last seen:2021-11-18 09:21:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:84m31gW73grFaJw1gQFK3CARY4x86PkcGL7:tm3KWWAS1gQnqLxOL7
Threatray 192 similar samples on MalwareBazaar
TLSH T1D8D4D0A036B8C827E37081B5C6B0D3BA4B70716D0DE5C6427CEE6ADF7A697647C58312
Reporter lowmal3
Tags:exe Neshta

Intelligence

File Origin
# of uploads :
3
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO#6018634905996.exe
Verdict:
Malicious activity
Analysis date:
2021-11-18 07:05:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7d8927aa-ae34-43ac-9b82-b2e4e804938b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.GCW.genEldorado.29783.4331.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
DNS request
Using the Windows Management Instrumentation requests
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6195f88d4912a8c920a24b88/reports/0ffc1a6e-bda5-4268-b14d-31a3f18727ee/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Neshta
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ecb5f5f-2456-4f00-b4e2-7f4368e75f03
Result
Threat name:
Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/891733
Signature
.NET source code contains potential unpacker
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Neshta
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec/
Threat name:
ByteCode-MSIL.Trojan.Gorgon
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 06:54:07 UTC
AV detection:
9 of 44 (20.45%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugwh5bkjg5fwn3rrzdhjin4qegnlrzyflh3475v4wahgldqpk3wa._file
Verdict:
malicious
Similar samples:
0f588cc0f351e5a7a82372fb978693bd088484d89d2219267a4fd7f7c52203d8
Neshta
0fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
Neshta
412bcb0abe4197be23ae265308d96f9db0f0fd5f96ec0ac053d744d1565e80eb
Neshta
6449b0b19510e8c167d7bbc8a8471f81deadda1730c5889147589db21f30cd76
Neshta
a73f2d92c3d48bad18d6a33530cedee50fb1495030c752d406045c113eeabd0a
Neshta
b0bd95ea0aa5de9849e555fc8a62f51e1406c6b4dc890ce9a63c9807184d9f0b
Neshta
b2ae47f62aa239fb6badfb8af83054c008e9c93d6fe1953732ec03029dc474ce
Neshta
de544199796705d18dad9dcf238c7c96de3fc8c793057cad94e319527af9c7bd
Neshta
e1b0ef4dd27c829683569165d98c902a8ed2f2eaa95b1540c6430f5ea3be0b3f
Neshta
+ 182 additional samples on MalwareBazaar
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:neshta evasion persistence spyware stealer
Link:
https://tria.ge/reports/211118-hn8c8sbgej/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Detect Neshta Payload
Modifies system executable filetype association
Neshta
Unpacked files
SH256 hash:
ed2e3ed7b6084e1a415a0f6c57fb0065eb06f4a45303df003677ba2afd88c911
MD5 hash:
ff93282b4438d977e78247058cb441f1
SHA1 hash:
cc7a73054c6326e4f7e4cc627c82f7318a2fb05b
Link:
https://www.unpac.me/results/e911a93b-bd07-4d73-9ff8-64b28adc8880/
SH256 hash:
cc5c5860e83b708cd158454165cbeb714767119946049de5aa7677685be75c14
MD5 hash:
83cbea4dec6e5b64a85ee9b6f9ff7598
SHA1 hash:
5c1d12b792c32ba73b7bf2634da5e4d9fbcd7d4e
Link:
https://www.unpac.me/results/e911a93b-bd07-4d73-9ff8-64b28adc8880/
SH256 hash:
601988fc7daae671a0a27b38d9212e6a8fdfd9110dd099153fcf80f826a2d2e1
MD5 hash:
3024a3be79d03af30cb5ef949b1c1d09
SHA1 hash:
2628411c7216202f7d54c8f64a596cc46e465f3f
Detections:
win_neshta_auto
Create hunting rule
Link:
https://www.unpac.me/results/e911a93b-bd07-4d73-9ff8-64b28adc8880/
Parent samples :
70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005
a73f2d92c3d48bad18d6a33530cedee50fb1495030c752d406045c113eeabd0a
0f588cc0f351e5a7a82372fb978693bd088484d89d2219267a4fd7f7c52203d8
a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec
37788378096171de3632795ccedd7562dc5f514497394dcdb9fbbea8960cce6f
SH256 hash:
a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec
MD5 hash:
9cdeb7a57e0b78f5a7b7d79e557d3dfe
SHA1 hash:
07eb1aea9e88b5edb608bc2fe66da0fc9199f3bd
Link:
https://www.unpac.me/results/e911a93b-bd07-4d73-9ff8-64b28adc8880/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a1ac7e854937/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Neshta
Create hunting rule
Author:ditekSHen
Description:Detects Neshta
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Neshta

Executable exe a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/207101/

Comments