MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9ba8137d635ef997c4d1388b7758157fa8ee4bfffcacc49bdf7c5dfe9003421. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9ba8137d635ef997c4d1388b7758157fa8ee4bfffcacc49bdf7c5dfe9003421
SHA3-384 hash: 85724f9cf62ea6cb6a9c8616ea46d25b5db8e3013f4f89c3f8112704c892b278f183c01e1cdd4ce6d118c3ffc8d690ca
SHA1 hash: 69a81fd68106c9de3fa4657cec2468c29a45a171
MD5 hash: 748f5d75a9f4c4026cc14e46baff0bb3
humanhash: december-sad-november-paris
File name:748f5d75a9f4c4026cc14e46baff0bb3
Download: download sample
Signature Neshta
Create hunting rule
File size:750'080 bytes
First seen:2021-11-25 19:21:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:xBzcmhiTIabUtWTlW/kcbP3/1S/XTBWym1jr0ahKpymrF9oZXKanCB7U3WJ3m5Ja:xBomhiE5tWxWBz/1YjBZm1jrdhm999Um
Threatray 205 similar samples on MalwareBazaar
TLSH T1FDF4011133B85E5FCBBE07FA9464544057F2AA1AA1AFD7DD8CC0B0ED09E1F525B02A27
Reporter zbetcheckin
Tags:32 exe Neshta

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment Advice HSBC.xlsx
Verdict:
Malicious activity
Analysis date:
2021-11-25 17:06:31 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/a5652785-9fa3-4e86-a5ab-0eb744ac8288

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Сreating synchronization primitives
Unauthorized injection to a recently created process
Creating a file
Creating a file in the %temp% subdirectories
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/619fe25ff36138de3f3d0c58/reports/c9a76c4c-fda6-44a8-af65-8ee59a89ac5e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
HackingTeam
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6a2a5aea-3e18-4e9f-9069-130805838683
Result
Threat name:
FormBook Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/896344
Signature
.NET source code contains potential unpacker
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Yara detected Neshta
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9ba8137d635ef997c4d1388b7758157fa8ee4bfffcacc49bdf7c5dfe9003421/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-25 03:58:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
67
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
388edd3ce26d9cc673521915d3289a230f3ea8d1967b504104286c71c9231123
Neshta
551ba1376b60bc3db5419ed3bf6f174d6ed86e54aee8c85058944df5b22e525e
Neshta
7352da07eb5255a3f8c927df34afe626293f94d285fedd40c63cace95a5b0d4b
Neshta
8165ac99e7dbfb2059308aaa1105ede0f191bb846d14dfd7ed709c3bcfb88510
Neshta
83cdd5dcc2e416527f5855b114bbef5c48b539bda3edafe503f33e0e9ca6f229
Neshta
8be9016662cf61e10c4b1d6d0e8bc47bb210928a8e8d68f994fd05cc36e82b38
Neshta
949d911ef54a1c977e3c7084d6dbf22c87e9757f6a850afa7f73c5dd32b174ef
Neshta
9592050af0d35d9a97d5720f1acd525e76babfcacd60d0aea550a1c950def136
Neshta
f185ad3bc5b9b0942f52a63aaa8651c79b6bec5bc4e97ef2f0bdd67800618d4a
Neshta
+ 195 additional samples on MalwareBazaar
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:neshta persistence spyware stealer
Link:
https://tria.ge/reports/211125-x28ngsgdcm/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Modifies system executable filetype association
Neshta
Unpacked files
SH256 hash:
e5a19cae91a47621ed06e9d6434e73e2ba289981d7f71cf30e1e112bae3acc7b
MD5 hash:
232f06fde30ca808e38283e42fcfb707
SHA1 hash:
4489d4661574ad0a5bcf4059ba0aea21220b5aa6
Link:
https://www.unpac.me/results/bef87681-60dd-4964-9182-4b4be573b644/
SH256 hash:
f6639a3b21a09ca5e9e43e10f8ac7f822956232806805252096f03f68bc9815c
MD5 hash:
aa334e922c53c5cba0b43c342ac13b14
SHA1 hash:
68109327b5e98174293bb348dfea6a088cbd5d2f
Link:
https://www.unpac.me/results/bef87681-60dd-4964-9182-4b4be573b644/
SH256 hash:
d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e
MD5 hash:
2f50aca08ffc461c86e8fb5bbedda142
SHA1 hash:
6fc5319d084c6e13f950c24c78a9cadb7793c638
Detections:
win_neshta_auto
Create hunting rule
Link:
https://www.unpac.me/results/bef87681-60dd-4964-9182-4b4be573b644/
Parent samples :
6315729f81fe55e4121e212fe2fb769e9cfbfba2178df45be066d5921817e371
a56201e88978eee0be785d68c9f510b25dc8d5e702af0b9d17dec5e507fc3626
ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338
a9ba8137d635ef997c4d1388b7758157fa8ee4bfffcacc49bdf7c5dfe9003421
7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a
de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
efc11f7b37fb2e8708e9299d4543c4e45963df369e408320b9d1d04aa5dbac62
12afbeae36c86ffa1781c6faac9cd3b460fe5835c55b901e7ec28e39df418d5e
6eb16df08e9ce41a8c5355c19817741c79386a93c402ffdbbffb5e221e609ab6
c10e5f7f008da5ed2a5b08326d57e7d6b052644df78facc7bbdca7b0ed366254
d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e
08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
SH256 hash:
a9ba8137d635ef997c4d1388b7758157fa8ee4bfffcacc49bdf7c5dfe9003421
MD5 hash:
748f5d75a9f4c4026cc14e46baff0bb3
SHA1 hash:
69a81fd68106c9de3fa4657cec2468c29a45a171
Link:
https://www.unpac.me/results/bef87681-60dd-4964-9182-4b4be573b644/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.83
Link:
https://yomi.yoroi.company/submissions/a9ba8137d635ef997c4d1388b7758157fa8ee4bfffcacc49bdf7c5dfe9003421

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Neshta

Executable exe a9ba8137d635ef997c4d1388b7758157fa8ee4bfffcacc49bdf7c5dfe9003421

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1809274/
  
URLhaus
https://urlhaus.abuse.ch/url/1817279/
Cape
Cape
https://www.capesandbox.com/analysis/209492/

Comments


Avatar
zbet commented on 2021-11-25 19:21:42 UTC

url : hxxp://198.12.91.205/50005/vbc.exe