MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d95b7662657d3b40b573156c5bac4981d9f3abc4bb8ef3952502207cea5e619b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 8

Intelligence 8 IOCs YARA 11 File information Comments

SHA256 hash:	d95b7662657d3b40b573156c5bac4981d9f3abc4bb8ef3952502207cea5e619b
SHA3-384 hash:	7725568ced7299c2c15dbe2a9b03ca6aad54aab44dfe6a2eb4e084c3b2da73601df98a9f406e23c1bb46c3597a0bf641
SHA1 hash:	b8e2e7836196bad9d1d7e73e38b45438474d5cff
MD5 hash:	d910d54f763c3ef58be43471a1d4c0d5
humanhash:	william-magnesium-black-double
File name:	QSPC03PC230308097.zip
Download:	download sample
Signature	Neshta Create hunting rule
File size:	759'446 bytes
First seen:	2024-03-29 10:20:01 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:AIAe96rmOcwZdAl42G7tzMzl+D1+5i5BBiN+oISf00I0:AIAeIrOmdAl4v6+R+5i5KN3Ia0k
TLSH	T1C2F423712A66B3BC5063784FB4E9855BC76C1378400B9F7789D8EC50168EA9FCE97828
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	Neshta QUOTATION zip

cocaman

Malicious email (T1566.001)
From: "spare@rmsmarineservice.sg" (likely spoofed)
Received: "from rmsmarineservice.sg (unknown [162.245.191.145]) "
Date: "28 Mar 2024 13:05:44 -0700"
Subject: "FW: inquiry sam QSPC03PC230308097 Blue Sky 1 - Quotation Request"
Attachment: "QSPC03PC230308097.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

235

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	QSPC03PC230308097.exe
File size:	878'592 bytes
SHA256 hash:	0737b4a17fda7c3b5ffe49d1f33da4b1789d0f3b7c77a54113d6136f1672782a
MD5 hash:	a2242c1c19df8b628a64165e062b03a3
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/d95b7662657d3b40b573156c5bac4981d9f3abc4bb8ef3952502207cea5e619b/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/660695d4ec04992a87d24f08/reports/4b25204e-b1a7-45f3-93ee-74d31fa02942/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d95b7662657d3b40b573156c5bac4981d9f3abc4bb8ef3952502207cea5e619b

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/d95b7662657d3b40b573156c5bac4981d9f3abc4bb8ef3952502207cea5e619b

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta persistence spyware stealer

Link:

https://tria.ge/reports/240329-mdncjafe88/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Modifies system executable filetype association

Reads user/profile data of web browsers

Detect Neshta payload

Neshta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.88

Link:

https://yomi.yoroi.company/submissions/d95b7662657d3b40b573156c5bac4981d9f3abc4bb8ef3952502207cea5e619b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	MALWARE_Win_Neshta Create hunting rule
Author:	ditekSHen
Description:	Detects Neshta

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Virus_Neshta_2a5a14c8 Create hunting rule
Author:	Elastic Security

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator