MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc7acefe9386fd39ac9824a0d63414d3ee9ca7825e935ab1fa4590eac85e64fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 10

Intelligence 10 IOCs YARA 20 File information Comments

SHA256 hash:	dc7acefe9386fd39ac9824a0d63414d3ee9ca7825e935ab1fa4590eac85e64fc
SHA3-384 hash:	5d045126f0acb8b8389d2243310e2287cf95af001f5745fb7a012489aa78ee68c5383e030d12b115b945b8cc8df111fc
SHA1 hash:	57364775a68d0f0aa744d6dfa89a408a2c84cc00
MD5 hash:	e7407bc9fbdf66884f41e80bbe704301
humanhash:	five-muppet-kilo-snake
File name:	SOA 31 MARCH.zip
Download:	download sample
Signature	Neshta Create hunting rule
File size:	726'397 bytes
First seen:	2025-04-11 06:59:46 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:T03vDBRcRzcg/TzocRhkO0LdO/FQFpbEJ+6HvYrQXGWGiyAgRqRAtqGV1vvs:A/EAiTz9SOed2MBEJ+6HvY+phyAyBqkE
TLSH	T1ABF43361B84E01E236F72FA24C45002B1FCC2760AB953E645947753CDCEBA27BA91C7B
Magika	zip
Reporter	cocaman
Tags:	Neshta zip

cocaman

Malicious email (T1566.001)
From: "roseu<roseu@eri-rwanda.com>" (likely spoofed)
Received: "from eri-rwanda.com (unknown [107.173.177.148]) "
Date: "11 Apr 2025 00:06:03 +0200"
Subject: "SOA OF MARCH<Please check and confirm "
Attachment: "SOA 31 MARCH.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

354

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SOA 31 MARCH.exe
File size:	760'832 bytes
SHA256 hash:	8734c94b5ebc9260065d6ac359500b8f17f290be6c74bb72b9c0cacccf9b7d63
MD5 hash:	69de4004dfc979d1b8a0eff23483ac83
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_fs3271.UNOFFICIAL

SecuriteInfo.com.Variant.Genie.8DN.251.6471.8604.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f733fa71beff15dccefa8f

Tags:

installer dropper corrupt neshta

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/dc7acefe9386fd39ac9824a0d63414d3ee9ca7825e935ab1fa4590eac85e64fc/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/67f8bdfa2d430c849e1349ad/reports/9ee07ae3-34e7-4a9c-bc29-181cbe06848b/overview

Verdict:

Suspicious

Labled as:

Virus.U.Neshta

Link:

https://www.hybrid-analysis.com/sample/dc7acefe9386fd39ac9824a0d63414d3ee9ca7825e935ab1fa4590eac85e64fc

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/dc7acefe9386fd39ac9824a0d63414d3ee9ca7825e935ab1fa4590eac85e64fc

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta discovery persistence spyware stealer

Link:

https://tria.ge/reports/250411-jrm25stmx2/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Checks computer location settings

Modifies system executable filetype association

Reads user/profile data of web browsers

Detect Neshta payload

Neshta

Neshta family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dc7acefe9386fd39ac9824a0d63414d3ee9ca7825e935ab1fa4590eac85e64fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	MALWARE_Win_Neshta Create hunting rule
Author:	ditekSHen
Description:	Detects Neshta

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	neshta_v1 Create hunting rule
Author:	RandomMalware

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Virus_Neshta_2a5a14c8 Create hunting rule
Author:	Elastic Security

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator