MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbbc739141bb77117b553b895cffdf1f8239fa0ec3d59854fd8736531d025dd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 10

Intelligence 10 IOCs YARA 48 File information Comments

SHA256 hash:	dbbc739141bb77117b553b895cffdf1f8239fa0ec3d59854fd8736531d025dd0
SHA3-384 hash:	52c3b30798eb4d208ca91d258e8a3f8ed763c0addb6af9d5ec2561225289232f6c8084182b98199156316d69e8c526a2
SHA1 hash:	30db6f9892c66973637e2c5420b84063308f8812
MD5 hash:	43c06007808b23da04eed6a60ec7b457
humanhash:	bluebird-zulu-muppet-mississippi
File name:	Arrival Notice.zip
Download:	download sample
Signature	Neshta Create hunting rule
File size:	83'601 bytes
First seen:	2025-04-17 09:30:14 UTC
Last seen:	2025-04-17 11:23:57 UTC
File type:	zip
MIME type:	application/zip
ssdeep	1536:MrWTxw3IVy9IDYcGHU26xxQJN/TcTdzGoTVuviJYNS0THGIon:feYV0IkcGHp6xqN/OGoTVuviJc5HGIon
TLSH	T144830228DFC840D0C4F05E1DF5ED18AA6E60FA20FC6C867C7BEAB5922DB541159456B3
Magika	zip
Reporter	cocaman
Tags:	Neshta zip

cocaman

Malicious email (T1566.001)
From: "interfreight@intership.com.jm" (likely spoofed)
Received: "from intership.com.jm (unknown [107.173.177.148]) "
Date: "17 Apr 2025 13:22:09 +0200"
Subject: "Arrival Notices-Hoegh Transporter v/162-Niche Motors Ltd"
Attachment: "Arrival Notice.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

336

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	FresheR.exe
File size:	319'488 bytes
SHA256 hash:	c430eda3d7263ffd0e07235b29cd7f54961c51091e4ab3bc38d72891c6233e61
MD5 hash:	2f88e06d6e5adf6721527bf8d6553fbf
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Detection(s):

Win.Trojan.Neshuta-1

Win.Virus.Neshta-7101689-0

Win.Malware.Generic-10008460-0

Win.Trojan.Jadtre-5

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6800ce2e280f5f89a0d0537d

Tags:

neshta dotnet virus smtp

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/dbbc739141bb77117b553b895cffdf1f8239fa0ec3d59854fd8736531d025dd0/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

borland_delphi cmd evasive fingerprint hacktool lolbin neshta netsh overlay packed packer_detected stealer stealer

Link:

https://www.filescan.io/uploads/6800ca39e9c1e257979bd328/reports/60405328-70d3-4989-9415-858a4fbc9621/overview

Verdict:

Malicious

Labled as:

Virus.Neshta.ka

Link:

https://www.hybrid-analysis.com/sample/dbbc739141bb77117b553b895cffdf1f8239fa0ec3d59854fd8736531d025dd0

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/dbbc739141bb77117b553b895cffdf1f8239fa0ec3d59854fd8736531d025dd0

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:neshta family:vipkeylogger collection discovery keylogger persistence spyware stealer

Link:

https://tria.ge/reports/250417-lklxlsvn16/

Behaviour

outlook_win_path

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Modifies system executable filetype association

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detect Neshta payload

Neshta

Neshta family

VIPKeylogger

Vipkeylogger family

Malware Config

C2 Extraction:

https://api.telegram.org/bot8016404655:AAEsTfOcR-DjhV53FmbGXK9eLPYnncPBO-w/sendMessage?chat_id=7551782158

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	EXE_Virus_Neshta_March2024 Create hunting rule
Author:	Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_Neshta Create hunting rule
Author:	ditekSHen
Description:	Detects Neshta

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	neshta_v1 Create hunting rule
Author:	RandomMalware

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Virus_Neshta_2a5a14c8 Create hunting rule
Author:	Elastic Security

Rule name:	win_404keylogger_g1 Create hunting rule
Author:	Rony (@r0ny_123)

Rule name:	win_neshta_g0 Create hunting rule
Author:	gpalazolo
Description:	This rule identifies Neshta Malware.
Reference:	https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest