MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d02f17228f28187d3a63ea2f68df1641e0136f5225fa49211a8ff8a5340a4744. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	d02f17228f28187d3a63ea2f68df1641e0136f5225fa49211a8ff8a5340a4744
SHA3-384 hash:	bc68f3de3b4625b67dd35e6f39fd573e792b4aa06935c792ffe9397fc18398dc08b97dc79c63aab9f77ae27e0eba2b0c
SHA1 hash:	38a465a7ff3eb4651f534e42bab25634666ef0ae
MD5 hash:	042938fb3342cf83d4336ed534f5aa92
humanhash:	arizona-london-lima-william
File name:	BANK FUNDED SLIP COPY.rar
Download:	download sample
Signature	Neshta Create hunting rule
File size:	667'107 bytes
First seen:	2023-06-14 08:56:50 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:t6REIGWDcLSikLt0FFFG70eeJ0AiLIPD9E9WBfMtwNvJK+s7lt+SzWYYG:7I4u/LuFkAjJ0pyzfMtwZ1SzfT
TLSH	T1B1E4234D6AF03C5900AF6FF0D924375140EE8AE4D31DC1A7A88F0BB55876BC66A636E1
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	Neshta payment rar

cocaman

Malicious email (T1566.001)
From: "info <info09@poituox.fr>" (likely spoofed)
Received: "from mail.poituox.fr (unknown [87.121.221.219]) "
Date: "Wed, 14 Jun 2023 03:39:06 +0300"
Subject: "Re: Yesterday Payment Funded proof for your record."
Attachment: "BANK FUNDED SLIP COPY.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

123

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	BANK FUNDED SLIP COPY.exe
File size:	872'448 bytes
SHA256 hash:	393d94791809b4059141bd1d6de789b431a71eb544bc7f7b0d7a1700c042ece5
MD5 hash:	625b0222413f234ef2dc85f735c74782
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/d02f17228f28187d3a63ea2f68df1641e0136f5225fa49211a8ff8a5340a4744/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/648980df42386ee977f42529/reports/15df00eb-fd78-4036-953d-a4a1af6ff396/overview

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/d02f17228f28187d3a63ea2f68df1641e0136f5225fa49211a8ff8a5340a4744

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d02f17228f28187d3a63ea2f68df1641e0136f5225fa49211a8ff8a5340a4744/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-06-14 07:15:07 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 36 (47.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2axroiupfamh2otd5ixwrxywihqbg32sex5esii2r74kknaki5ca._file

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta persistence spyware stealer

Link:

https://tria.ge/reports/230614-larp4sfd42/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Checks computer location settings

Modifies system executable filetype association

Reads user/profile data of web browsers

Detect Neshta payload

Neshta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d02f17228f28187d3a63ea2f68df1641e0136f5225fa49211a8ff8a5340a4744

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.