MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1bfcefa81d738c9cccd256d39be3ec4f4663e7d045e47bee08871482be3e3db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 8

Intelligence 8 IOCs YARA 13 File information Comments

SHA256 hash:	e1bfcefa81d738c9cccd256d39be3ec4f4663e7d045e47bee08871482be3e3db
SHA3-384 hash:	5afa4e99c4110bbcf3f1d8a8ed1510dd9dbb75d74c62450d54284b395740e658082f4c21e25b140e93094c90f18048fb
SHA1 hash:	6022333fafb5838194df8865279585cb4c406f2f
MD5 hash:	a5f8c4a6e0d0a9729773be1c730aa7c7
humanhash:	sodium-don-king-october
File name:	Order RFQ-HL51L05.zip
Download:	download sample
Signature	Neshta Create hunting rule
File size:	696'738 bytes
First seen:	2024-04-16 10:55:35 UTC
Last seen:	2024-04-18 20:34:36 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:pNlPyweTrAdJhppIEp9/eAJZrsZEL6S7HCeZDVyxZBK1j6NSWtWVvsIyVN8zm5:pNlPyqhHJtsZE7iAVy/BvNSW0EIyrum5
TLSH	T1A3E4237F302BA9F5E2BD043F4F27A192867D2833583A4C3E46E22B57929F118C753295
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	Neshta RFQ zip

cocaman

Malicious email (T1566.001)
From: "h.alkhatib@albinagroup.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.116]) "
Date: "16 Apr 2024 12:54:25 +0200"
Subject: "RE: Quoted INV-153BDO."
Attachment: "Order RFQ-HL51L05.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

254

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Order RFQ-HL51L05.exe
File size:	745'984 bytes
SHA256 hash:	fc7c9c64d0801f66f22ea258673b12b73f392b958cf38dbf14432dcdb3037e5a
MD5 hash:	9762ce69c2bf80bf5ffd1029ac0b11ec
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/e1bfcefa81d738c9cccd256d39be3ec4f4663e7d045e47bee08871482be3e3db/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade obfuscated packed

Link:

https://www.filescan.io/uploads/661e5946b575a100a2301854/reports/c7aabee7-4632-40a6-afef-29f23f61375e/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e1bfcefa81d738c9cccd256d39be3ec4f4663e7d045e47bee08871482be3e3db

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/e1bfcefa81d738c9cccd256d39be3ec4f4663e7d045e47bee08871482be3e3db

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta persistence spyware stealer

Link:

https://tria.ge/reports/240416-m3dvdsgf83/

Behaviour

Creates scheduled task(s)

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Modifies system executable filetype association

Reads user/profile data of web browsers

Detect Neshta payload

Neshta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e1bfcefa81d738c9cccd256d39be3ec4f4663e7d045e47bee08871482be3e3db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	MALWARE_Win_Neshta Create hunting rule
Author:	ditekSHen
Description:	Detects Neshta

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	neshta_v1 Create hunting rule
Author:	RandomMalware

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Virus_Neshta_2a5a14c8 Create hunting rule
Author:	Elastic Security

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator