MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5e477805f7686cbcef90f9ecaed8aa9a438bd1bac0842d3b11b6fe8bce76356. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5e477805f7686cbcef90f9ecaed8aa9a438bd1bac0842d3b11b6fe8bce76356
SHA3-384 hash: af2ea7ec599186ddd39edb3e4dac0a20c0751c21d96115f446281f8ff07c0a8ba4e435b8fee1d4583caedd2d34e49f16
SHA1 hash: bbe1832ecbefbc63171865054ac576dc94b03eef
MD5 hash: 14c21aabab60328191f5093b252fd3f3
humanhash: potato-ohio-avocado-fifteen
File name:14c21aabab60328191f5093b252fd3f3.exe
Download: download sample
Signature Neshta
Create hunting rule
File size:357'912 bytes
First seen:2021-07-30 08:52:00 UTC
Last seen:2021-07-30 09:56:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 79bcb07d7acd978f9ca84095c744e3ba (3 x Formbook, 2 x SnakeKeylogger, 1 x Neshta)
ssdeep 6144:sNgorZykBIJ/iZYOK7JVEWEWulB2OBDhrOGqH5odK2B/tzKjFrScj6BdWSvMCEwp:aZrRBnyOK7vEWEnlAOR85EKgKjj6Bd3v
Threatray 96 similar samples on MalwareBazaar
TLSH T1477401EDCA03090BD025CDFD8197A21CA82554E5D76AAE9702E5FF2E077C6C0FD36296
Reporter abuse_ch
Tags:exe Neshta

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'282
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
14c21aabab60328191f5093b252fd3f3.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-30 08:56:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f3be8b4c-9d4c-49c7-bd4d-2ee6a80b66f3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
neshta
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175255/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.15166.487.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Neshta
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e9c7cb3d-1d68-46c1-bdf1-2e9176dbfbd4
Result
Threat name:
Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/824417
Signature
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Drops executable to a common third party application directory
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Yara detected Neshta
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5e477805f7686cbcef90f9ecaed8aa9a438bd1bac0842d3b11b6fe8bce76356/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-07-30 08:52:42 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yxshpac7o2dmxtxzb6pmv3mkvgsdrpi3vqeefu5rdnx6rphhmnla._file
Verdict:
malicious
Similar samples:
0f588cc0f351e5a7a82372fb978693bd088484d89d2219267a4fd7f7c52203d8
Neshta
1aae387dce8782d2f58887aa73dd970e51656c72ada983fb040989656a6dc47e
Neshta
412bcb0abe4197be23ae265308d96f9db0f0fd5f96ec0ac053d744d1565e80eb
Neshta
4ba041292881b73bc2cf7842f17b64eeca555b209577f5ea842fbeaa30f05ea0
Neshta
6116018c9a9550c912fdd717f2f3e811339feb4149012f3a15d40a80a492ab8e
Neshta
a73f2d92c3d48bad18d6a33530cedee50fb1495030c752d406045c113eeabd0a
Neshta
b2ae47f62aa239fb6badfb8af83054c008e9c93d6fe1953732ec03029dc474ce
Neshta
e82473f02711056cbcda98d22a858d95c6cf574c17ee77ea62db86e405ff6e77
Neshta
fdec06df5406c4ce7396704a8160927a2bdceeac0bb111b702ec310498e9a5ba
Neshta
+ 86 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/210730-3mr4pz3fts/
Behaviour
Modifies registry class
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Modifies system executable filetype association
Unpacked files
SH256 hash:
0a856419b518368cb9945d8bfb2b05fb2763db8a9bca7f5280ca1a487855a4ec
MD5 hash:
15d8ab38054a766318c235ee74ac10e8
SHA1 hash:
836c007d0760f9ba204f73553518004c2d7a6746
Detections:
win_neshta_auto
Create hunting rule
Link:
https://www.unpac.me/results/9eae1a6c-bd9d-4b6b-9e11-0ee58c6c564e/
Parent samples :
c991dbd92d2f3e6f3ff5d1de12016460a2cb557f7482d3322c7b495f0cbe9b89
6116018c9a9550c912fdd717f2f3e811339feb4149012f3a15d40a80a492ab8e
c5e477805f7686cbcef90f9ecaed8aa9a438bd1bac0842d3b11b6fe8bce76356
SH256 hash:
c5e477805f7686cbcef90f9ecaed8aa9a438bd1bac0842d3b11b6fe8bce76356
MD5 hash:
14c21aabab60328191f5093b252fd3f3
SHA1 hash:
bbe1832ecbefbc63171865054ac576dc94b03eef
Link:
https://www.unpac.me/results/9eae1a6c-bd9d-4b6b-9e11-0ee58c6c564e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
Link:
https://yomi.yoroi.company/submissions/c5e477805f7686cbcef90f9ecaed8aa9a438bd1bac0842d3b11b6fe8bce76356

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Neshta

Executable exe c5e477805f7686cbcef90f9ecaed8aa9a438bd1bac0842d3b11b6fe8bce76356

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1490120/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/175255/

Comments