MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8b827cd176b26afa22b83db2c598961d4f67b454ca87f72774066cf692dab37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8b827cd176b26afa22b83db2c598961d4f67b454ca87f72774066cf692dab37
SHA3-384 hash: bea1ae73e011ae98768a0c9c12de2549615a51d9defd268eb60f1f93e865dab9e759f96d5b521db4e0bf73ed6808d8e2
SHA1 hash: 8a983e57e7654527cd2827ece8f7d7c81175437e
MD5 hash: 69eec47380f487567aac36cc35d50826
humanhash: carbon-four-william-fish
File name:02624999.exe
Download: download sample
Signature Neshta
Create hunting rule
File size:1'485'955 bytes
First seen:2023-05-26 12:09:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f4693fc0c511135129493f2161d1e86 (253 x Neshta, 15 x Formbook, 14 x AgentTesla)
ssdeep 24576:d4PbCGol1MBz4VrqabgBs/8KmXOoU5Ll7cZFT//yLQxoz4zKot2:ahWAUrqQg632T//Oz4zKR
Threatray 119 similar samples on MalwareBazaar
TLSH T15E651376E4C3C470E977503089A1CB61D56DBB301EB00567E3CC6EAD6BB13B3AA1A746
TrID 74.5% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
12.2% (.EXE) InstallShield setup (43053/19/16)
4.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
3.7% (.SCR) Windows screen saver (13097/50/3)
1.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon a2a2e3e38383a2a1 (2 x Amadey, 1 x Neshta)
Reporter Neiki
Tags:Neshta

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
02624999.exe
Verdict:
Malicious activity
Analysis date:
2023-05-26 12:11:17 UTC
Tags:
installer
Link:
https://app.any.run/tasks/8293a980-c1b2-437e-809f-68a4a967ee6e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Neshta
Create hunting rule
Link:
https://www.capesandbox.com/analysis/392064/
Detection(s):
Win.Trojan.Neshuta-1
Create hunting rule

PUA.Win.Packer.Pequake-4
Create hunting rule

Win.Virus.Neshta-7101689-0
Create hunting rule

Win.Trojan.Jadtre-5
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file in the Windows directory
Modifying an executable file
Creating a window
Searching for synchronization primitives
Creating a file
Creating a file in the Program Files subdirectories
Creating a process with a hidden window
Running batch commands
Sending a custom TCP request
Enabling autorun with the shell\open\command registry branches
Infecting executable files
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/88019/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin neshta overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6470a19eeabc80ed3afa95d8/reports/38296c2d-bd47-4939-9446-2c8bc4fe4ed5/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b8b827cd176b26afa22b83db2c598961d4f67b454ca87f72774066cf692dab37
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Neshta
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f6b44a8a-0fa3-471a-8cdc-8aecd8159f2f
Result
Threat name:
Babadeda, Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1243245
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Detected unpacking (overwrites its own PE header)
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with a suspicious file extension
Drops PE files with benign system names
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Yara detected Babadeda
Yara detected Neshta
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 876252 Sample: 02624999.exe Startdate: 26/05/2023 Architecture: WINDOWS Score: 100 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for dropped file 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 64 6 other signatures 2->64 11 02624999.exe 4 2->11         started        process3 file4 40 C:\Windows\svchost.com, PE32 11->40 dropped 42 C:\Users\user\Downloads\ChromeSetup.exe, PE32 11->42 dropped 44 C:\Users\user\AppData\Local\...\02624999.exe, PE32 11->44 dropped 46 69 other malicious files 11->46 dropped 74 Creates an undocumented autostart registry key 11->74 76 Drops PE files with a suspicious file extension 11->76 78 Drops executable to a common third party application directory 11->78 80 Infects executable files (exe, dll, sys, html) 11->80 15 02624999.exe 4 10 11->15         started        signatures5 process6 file7 48 C:\ProgramData\WindowsSecruity\svchost.exe, PE32 15->48 dropped 50 C:\ProgramData\WindowsSecruity\service.exe, PE32 15->50 dropped 52 C:\ProgramData\WindowsSecruity\autoexec.exe, PE32 15->52 dropped 54 2 other malicious files 15->54 dropped 56 Drops PE files with benign system names 15->56 19 svchost.com 1 15->19         started        signatures8 process9 file10 32 C:\Program Files (x86)\...\misc.exe, PE32 19->32 dropped 34 C:\Program Files (x86)\...\lync99.exe, PE32 19->34 dropped 36 C:\Program Files (x86)\...\WORDICON.EXE, PE32 19->36 dropped 38 38 other malicious files 19->38 dropped 66 Sample is not signed and drops a device driver 19->66 68 Infects executable files (exe, dll, sys, html) 19->68 23 SetUp.exe 1 8 19->23         started        signatures11 process12 signatures13 70 Detected unpacking (overwrites its own PE header) 23->70 72 Drops executables to the windows directory (C:\Windows) and starts them 23->72 26 svchost.com 23->26         started        process14 process15 28 cmd.exe 1 26->28         started        process16 30 conhost.exe 28->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8b827cd176b26afa22b83db2c598961d4f67b454ca87f72774066cf692dab37/
Threat name:
Win32.Virus.Neshta
Create hunting rule
Status:
Malicious
First seen:
2023-05-26 12:10:09 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xc4cptixnmtk7irlqpnsywmjmhkpm62fjsuh64txibtm62jnvm3q._file
Verdict:
malicious
Similar samples:
15df432e0f75857dbdb8da921cfffeed71244a95650b9fe8da19219999662d65
Neshta
49a326ef65fb6a7f8e778fb2104aa2708e38601348ddbc04e8cbd9117af0458a
Neshta
4b47e10740c284c9a1617a0f25548c1e25f2fd25aebac939339b2dfb0c882502
Neshta
8ccff473270017f72b0910ea0404d670cc6c0ebee16977accc7cbcf137ba168b
Neshta
8ec96a074255b7e90ae95d772c3b89e23289958eec3649ee26ca4071b3e66e9c
Neshta
a519b94cbb4c14b6fb3397c3220851ebf960fffe4f82360dbd4493bad0d38747
Neshta
e2f0a2043a3d8ae1e3b6c3f156a410544c2336108b244dd2f9b77f2f9ede0a56
Neshta
+ 109 additional samples on MalwareBazaar
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet family:neshta evasion persistence rat spyware stealer trojan upx
Link:
https://tria.ge/reports/230526-pb17qafh2t/
Behaviour
Creates scheduled task(s)
Kills process with taskkill
Modifies registry class
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Modifies system executable filetype association
Reads user/profile data of web browsers
UPX packed file
Windows security modification
Darkcomet
Detect Neshta payload
Modifies security service
Neshta
Windows security bypass
Unpacked files
SH256 hash:
b8b827cd176b26afa22b83db2c598961d4f67b454ca87f72774066cf692dab37
MD5 hash:
69eec47380f487567aac36cc35d50826
SHA1 hash:
8a983e57e7654527cd2827ece8f7d7c81175437e
Detections:
win_neshta_g0
Create hunting rule
Link:
https://www.unpac.me/results/9682c3d4-120a-4806-bd23-d271ffc11480/
Malware family:
Turla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b8b827cd176b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Neshta
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b8b827cd176b26afa22b83db2c598961d4f67b454ca87f72774066cf692dab37

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Neshta
Create hunting rule
Author:ditekSHen
Description:Detects Neshta
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Neshta malware
Reference:Internal Research
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/392064/

Comments