MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a67944e6f26b44910a85a2d9c3fbc7ee75968123246f2718d359c533d98edc2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 8

Intelligence 8 IOCs YARA 11 File information Comments

SHA256 hash:	a67944e6f26b44910a85a2d9c3fbc7ee75968123246f2718d359c533d98edc2d
SHA3-384 hash:	72f071284deb2f02ad6d4941474f15c8f7b156cbd812f8eca28a3c275abe8fdbd96a4fa93d0f5a0664d9811124d9ad70
SHA1 hash:	32ee60ddd2bbb7699f69f05a9d9faee2344b4457
MD5 hash:	194e488ec22ea041a71673080332ce0b
humanhash:	delaware-uncle-double-ten
File name:	PO No. 44 Master Group Trading & Contracting.zip
Download:	download sample
Signature	Neshta Create hunting rule
File size:	729'727 bytes
First seen:	2024-04-13 09:59:34 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:ShxvPYo2IQRGdQ4X8VVOFIAOMRNdcnJSNC2Du1Xemh/EOyrbl8PCiO068U3OJ:U3r2tgdQk2AOM5cn8NHDuBek/EOyX2PN
TLSH	T111F433F3DE113274E3E652EDCA6133D69523B5AA42161F1CEF1DEE4F121A620711EAB0
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	Neshta zip

cocaman

Malicious email (T1566.001)
From: "a.marie@placevendomeqatar.com" (likely spoofed)
Received: "from unassigned.quadranet.com (unknown [72.11.157.205]) "
Date: "11 Apr 2024 09:29:05 -0700"
Subject: "PO No. 44 Master Group Trading & Contracting (4mm aluminum directional parking - size: 65x100cm)"
Attachment: "PO No. 44 Master Group Trading & Contracting.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

238

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO No. 44 Master Group Trading & Contracting.exe
File size:	834'560 bytes
SHA256 hash:	dafe6d74868c243d4f818aab7c3f8d5d95b7d69aa1492e34e1e38d80d15e1532
MD5 hash:	77fceb05a851e129ceac74ad35a49669
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/a67944e6f26b44910a85a2d9c3fbc7ee75968123246f2718d359c533d98edc2d/results/dashboard

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/a67944e6f26b44910a85a2d9c3fbc7ee75968123246f2718d359c533d98edc2d

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/a67944e6f26b44910a85a2d9c3fbc7ee75968123246f2718d359c533d98edc2d

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta persistence spyware stealer

Link:

https://tria.ge/reports/240413-tbmfsahf4t/

Behaviour

Creates scheduled task(s)

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Modifies system executable filetype association

Reads user/profile data of web browsers

Detect Neshta payload

Neshta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/a67944e6f26b44910a85a2d9c3fbc7ee75968123246f2718d359c533d98edc2d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	MALWARE_Win_Neshta Create hunting rule
Author:	ditekSHen
Description:	Detects Neshta

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	neshta_v1 Create hunting rule
Author:	RandomMalware

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Virus_Neshta_2a5a14c8 Create hunting rule
Author:	Elastic Security

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator