MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5feb5ef614c161566bda4c742e979ece3c40ebe5ee6610e47b3a4798b3d50c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neshta


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5feb5ef614c161566bda4c742e979ece3c40ebe5ee6610e47b3a4798b3d50c5
SHA3-384 hash: b3668e7c58f8cf6b1cec585013f712a40dddd0d39dd03090e0d1302ec38f5abbce0d30363b00ce173382166e83e40b4f
SHA1 hash: 143da397c9b972247147da79b11ae72b4dae07e8
MD5 hash: b88b8e449bb192a4e02dd49eb86d63d7
humanhash: kansas-massachusetts-equal-artist
File name:e5feb5ef614c161566bda4c742e979ece3c40ebe5ee6610e47b3a4798b3d50c5.bin
Download: download sample
Signature Neshta
Create hunting rule
File size:439'587 bytes
First seen:2022-11-10 01:05:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f4693fc0c511135129493f2161d1e86 (253 x Neshta, 15 x Formbook, 14 x AgentTesla)
ssdeep 6144:k9rI7T8AzZV2MYORbAV9bQdnXgfyVQhAyPlb/F+bsn9:LIkEMtiQdwfyVQhAyPlb/wb
TLSH T15D946C45EB918CB6C920633B8DC7D237623CBAB40763DB576E651D28ED532E15E8D302
TrID 84.8% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
4.5% (.EXE) Win32 Executable Delphi generic (14182/79/4)
3.3% (.EXE) Win64 Executable (generic) (10523/12/4)
2.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.4% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Arkbird_SOLG
Tags:exe IceXLoader Neshta

Intelligence

File Origin
# of uploads :
1
# of downloads :
194
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e5feb5ef614c161566bda4c742e979ece3c40ebe5ee6610e47b3a4798b3d50c5.bin
Verdict:
Malicious activity
Analysis date:
2022-11-10 01:08:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e319854c-3406-499b-a718-ecf793375e24

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Neshta
Create hunting rule
Link:
https://www.capesandbox.com/analysis/331536/
Detection(s):
Win.Trojan.Neshuta-1
Create hunting rule

PUA.Win.Packer.Pequake-4
Create hunting rule

Win.Virus.Neshta-7101689-0
Create hunting rule

Win.Trojan.Jadtre-5
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file in the Windows directory
Modifying an executable file
Creating a file
Creating a file in the Program Files subdirectories
Sending a custom TCP request
Running batch commands
Launching a process
Enabling autorun with the shell\open\command registry branches
Infecting executable files
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm evasive neshta overlay shell32.dll spyeye
Link:
https://www.filescan.io/uploads/636c4e7e82dd9f2e26533f62/reports/0ad159ca-4218-4728-81a6-df28a42fb74a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Neshta
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/48ff43c1-6047-46eb-b656-277c33d2ff30
Result
Threat name:
IceXLoader, Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1109912
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Yara detected IceXLoader
Yara detected Neshta
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 742590 Sample: VeYQfSqJjv.exe Startdate: 10/11/2022 Architecture: WINDOWS Score: 100 52 Malicious sample detected (through community Yara rule) 2->52 54 Antivirus detection for URL or domain 2->54 56 Antivirus detection for dropped file 2->56 58 7 other signatures 2->58 14 VeYQfSqJjv.exe 4 2->14         started        process3 file4 44 C:\Windows\svchost.com, PE32 14->44 dropped 46 C:\Users\user\AppData\...\VeYQfSqJjv.exe, PE32 14->46 dropped 48 C:\ProgramData\...\vcredist_x86.exe, PE32 14->48 dropped 50 9 other malicious files 14->50 dropped 74 Creates an undocumented autostart registry key 14->74 76 Drops PE files with a suspicious file extension 14->76 78 Drops executable to a common third party application directory 14->78 80 Infects executable files (exe, dll, sys, html) 14->80 18 VeYQfSqJjv.exe 3 2 14->18         started        signatures5 process6 file7 40 C:\Users\user\Downloads\ChromeSetup.exe, PE32 18->40 dropped 60 Antivirus detection for dropped file 18->60 62 Multi AV Scanner detection for dropped file 18->62 64 Machine Learning detection for dropped file 18->64 22 svchost.com 1 18->22         started        signatures8 process9 file10 42 C:\Windows\directx.sys, ASCII 22->42 dropped 66 Antivirus detection for dropped file 22->66 68 Multi AV Scanner detection for dropped file 22->68 70 Machine Learning detection for dropped file 22->70 72 Sample is not signed and drops a device driver 22->72 26 VeYQfSqJjv.exe 1 2 22->26         started        signatures11 process12 process13 28 svchost.com 26->28         started        process14 30 VeYQfSqJjv.exe 1 2 28->30         started        process15 32 svchost.com 30->32         started        process16 34 VeYQfSqJjv.exe 1 2 32->34         started        process17 36 svchost.com 34->36         started        process18 38 VeYQfSqJjv.exe 1 2 36->38         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5feb5ef614c161566bda4c742e979ece3c40ebe5ee6610e47b3a4798b3d50c5/
Threat name:
Win32.Virus.Neshta
Create hunting rule
Status:
Malicious
First seen:
2022-10-15 03:23:28 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
26 of 26 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4x7ll33bjqlbkzv5utduf2lz5tr4idv6l3tgcdshwoshtcz5kdcq._file
Verdict:
malicious
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:icexloader family:neshta loader persistence spyware stealer
Link:
https://tria.ge/reports/221110-bf3z8adef9/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Checks computer location settings
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Detect Neshta payload
Detects IceXLoader v3.0
Modifies system executable filetype association
Neshta
icexloader
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7594b1df-9526-485e-9b65-4c0d8e25bfd7
Unpacked files
SH256 hash:
e5feb5ef614c161566bda4c742e979ece3c40ebe5ee6610e47b3a4798b3d50c5
MD5 hash:
b88b8e449bb192a4e02dd49eb86d63d7
SHA1 hash:
143da397c9b972247147da79b11ae72b4dae07e8
Detections:
win_neshta_g0
Create hunting rule
IceXLoader
Create hunting rule
win_icexloader_auto
Create hunting rule
win_icexloader_a0
Create hunting rule
Link:
https://www.unpac.me/results/971c0b87-ce8c-4338-9819-b18f61ca916d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e5feb5ef614c161566bda4c742e979ece3c40ebe5ee6610e47b3a4798b3d50c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Neshta
Create hunting rule
Author:ditekSHen
Description:Detects Neshta
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:win_icexloader
Create hunting rule
Rule name:win_icexloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.icexloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/331536/

Comments