MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c84a67238b495477b8bc83a7fa8ba57add83444f950a323225e7de219c5712c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments

SHA256 hash:	c84a67238b495477b8bc83a7fa8ba57add83444f950a323225e7de219c5712c5
SHA3-384 hash:	dbf798c4231fa43ae8352598a0d160fd047e67bd0fef35a94228070659f85a5e31b1809876fe8c59833be0664aaab805
SHA1 hash:	9b15f0e3f95e498700b773e3a0c93636d67f639b
MD5 hash:	bd7b5d1b41242632ff92404f16fd8fbf
humanhash:	coffee-missouri-skylark-carolina
File name:	PO2024-0961.pdf.gz
Download:	download sample
Signature	Neshta Create hunting rule
File size:	737'869 bytes
First seen:	2024-06-27 06:41:27 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	12288:kU6TXGvNv52lMzp8RVOlnHNaDZ4PTURrqUQXBlMHP5NGAkZyaD6hhzOsvUrUrf:kwNclMyOlHbkW7M+AiDcq+Ur8
TLSH	T1E9F4230BCDAAFB036FF2DCF201074E05397869683A494A7EEB1FB7464587693F925448
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	gz Neshta

cocaman

Malicious email (T1566.001)
From: "John Mak <john@atcline.com.hk>" (likely spoofed)
Received: "from atcline.com.hk (unknown [139.99.218.141]) "
Date: "26 Jun 2024 23:35:36 -0700"
Subject: "RE: IMPORT PO2024-0961 ASTG"
Attachment: "PO2024-0961.pdf.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO2024-0961.exe
File size:	1'239'552 bytes
SHA256 hash:	c10e5f7f008da5ed2a5b08326d57e7d6b052644df78facc7bbdca7b0ed366254
MD5 hash:	72f3a4a4cc00e2b6f64e0a204678de73
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Rogue.0hr.20240627-0632.UNOFFICIAL

Gathering data

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

autoit epmicrosoft_visual_cc fingerprint keylogger lolbin microsoft_visual_cc packed redcap shell32

Link:

https://www.filescan.io/uploads/667d09bc6b8dba248b46260d/reports/0b35fdd6-7ff9-49cb-943c-8d89a3f1aabf/overview

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/c84a67238b495477b8bc83a7fa8ba57add83444f950a323225e7de219c5712c5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c84a67238b495477b8bc83a7fa8ba57add83444f950a323225e7de219c5712c5/

Threat name:

Script-AutoIt.Trojan.Strab

Status:

Malicious

First seen:

2024-06-27 00:51:53 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

14 of 38 (36.84%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zbfgoi4ljfkhpof4qot7vc5fploygrcpsufdemrf47pcdhcxclcq._file

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta persistence spyware

Link:

https://tria.ge/reports/240627-hw3gys1ajl/

Behaviour

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Drops file in Windows directory

AutoIT Executable

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Neshta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c84a67238b495477b8bc83a7fa8ba57add83444f950a323225e7de219c5712c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator