MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338
SHA3-384 hash: 85085943b4c4f568560b2a8f1c8cb424b4e79660a349de0e4442d0fafdad58ed170f0991fcf94f126f25f240768200cc
SHA1 hash: dd11ca5e947fc96456676cf6e97d4e3ed8e80e98
MD5 hash: 70249955e9e48bdda0c0687b70999a51
humanhash: carbon-wyoming-neptune-oven
File name:70249955e9e48bdda0c0687b70999a51.exe
Download: download sample
Signature Neshta
Create hunting rule
File size:611'328 bytes
First seen:2021-11-24 19:36:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:otD00KRa8tJh0DZP+tmw34VJY1XqE0Tjh3dRiO:oC0SVtM8/o7YBmf5Xi
Threatray 212 similar samples on MalwareBazaar
TLSH T184D40254779867A7C87A5BF20C3190D503B2356A2910DA6EACC936CE6C36F061B12FF7
Reporter abuse_ch
Tags:exe Neshta

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
70249955e9e48bdda0c0687b70999a51.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-24 19:46:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a0b6b359-db1f-48d7-b741-34acd4ed1ac6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Сreating synchronization primitives
Unauthorized injection to a recently created process
Creating a file
Creating a file in the %temp% subdirectories
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/619e946502c80febc2a869a6/reports/8886f15a-f58e-4ee5-9c73-2f02474a5903/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7cf2c685-80a6-4b0b-bad2-453bb7ecbcef
Result
Threat name:
FormBook Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/895712
Signature
.NET source code contains potential unpacker
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Yara detected Neshta
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-24 19:37:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
16f75019c7de5d79c259d4b1f1003938bd6449ce3c49b28d6320bb43dd6bd82a
Neshta
21260151f07549ff5e1dc07ca6281d3fa876483f1dd014afde823fa0a0e0a1a2
Neshta
232f876999f6681e26051a522b6f2a73668c407b499f4bd5a0b64236dce25a1f
Neshta
511f5c0a9946188ad3dbbb58c2e2e5564402d83dd77379a39c8a17c660a737da
Neshta
6abec81da375b886b6e0fe09360f68980fcc3f51f00dbcdaf3a7945420e73b57
Neshta
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06
Neshta
99a897c5b8f53e1d04e51107c748a4f385b754a852ca6b605559f5b50820a64f
Neshta
a56201e88978eee0be785d68c9f510b25dc8d5e702af0b9d17dec5e507fc3626
Neshta
bd0eb6fff38b72907c56ad02467144b61744a7d24a054ce14eddf779854180ca
Neshta
fe31f9f04529e00c72d2b8957d0ed1e4031c463b0850a68b04310b03827c6120
Neshta
+ 202 additional samples on MalwareBazaar
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:neshta persistence spyware stealer
Link:
https://tria.ge/reports/211124-ybtx3sdeeq/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Modifies system executable filetype association
Neshta
Unpacked files
SH256 hash:
a028dba3aa4ec3688d1f989ffe5df2532fd5999444c4ee5b3d86342ccb11d296
MD5 hash:
c619d32ed91137974704f5da309b6811
SHA1 hash:
bf07a93169e94487c49049e6a03e5017e5ed47db
Link:
https://www.unpac.me/results/8142eda2-ae2b-4474-8286-01172b960df3/
SH256 hash:
302ac54c94e8bdb12b7fdaeef76e2b936e0294ea5b1ced38c6da51ef50c3067e
MD5 hash:
d1a58ca8f82c480763bfa3205e80b770
SHA1 hash:
7b23287d165b2dae07ead2625bd4e1e525d27a1b
Link:
https://www.unpac.me/results/8142eda2-ae2b-4474-8286-01172b960df3/
SH256 hash:
d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e
MD5 hash:
2f50aca08ffc461c86e8fb5bbedda142
SHA1 hash:
6fc5319d084c6e13f950c24c78a9cadb7793c638
Detections:
win_neshta_auto
Create hunting rule
Link:
https://www.unpac.me/results/8142eda2-ae2b-4474-8286-01172b960df3/
Parent samples :
6315729f81fe55e4121e212fe2fb769e9cfbfba2178df45be066d5921817e371
a56201e88978eee0be785d68c9f510b25dc8d5e702af0b9d17dec5e507fc3626
ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338
a9ba8137d635ef997c4d1388b7758157fa8ee4bfffcacc49bdf7c5dfe9003421
7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a
de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
efc11f7b37fb2e8708e9299d4543c4e45963df369e408320b9d1d04aa5dbac62
12afbeae36c86ffa1781c6faac9cd3b460fe5835c55b901e7ec28e39df418d5e
6eb16df08e9ce41a8c5355c19817741c79386a93c402ffdbbffb5e221e609ab6
c10e5f7f008da5ed2a5b08326d57e7d6b052644df78facc7bbdca7b0ed366254
d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e
08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
SH256 hash:
ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338
MD5 hash:
70249955e9e48bdda0c0687b70999a51
SHA1 hash:
dd11ca5e947fc96456676cf6e97d4e3ed8e80e98
Link:
https://www.unpac.me/results/8142eda2-ae2b-4474-8286-01172b960df3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ae27369e8286/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.83
Link:
https://yomi.yoroi.company/submissions/ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Neshta

Executable exe ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1809274/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/209172/

Comments