MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef963f69e02cbc0bdb2b4fd7d152780a5926f4bab8e679d0221bcb260132e191. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 8

Intelligence 8 IOCs YARA 20 File information Comments

SHA256 hash:	ef963f69e02cbc0bdb2b4fd7d152780a5926f4bab8e679d0221bcb260132e191
SHA3-384 hash:	3c33c3098c771a394ab11bdda6be27949f10d8f89adad2315cb172f463d5ec0ccec3eda8f9bfffed407cf65f239cbc9a
SHA1 hash:	1f1dbda8cda97b9bcad4bc0549bbef595e8f561f
MD5 hash:	1cd92a48197c7a820a2ff8a22cf41db5
humanhash:	glucose-network-single-nebraska
File name:	RFQ-HL51L05...rar.ZA
Download:	download sample
Signature	Neshta Create hunting rule
File size:	781'765 bytes
First seen:	2025-04-15 14:32:26 UTC
Last seen:	2025-04-15 19:03:54 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:rkKNWPNddvbHBZi5PjrV5ydie8J7D9AummSzDZjgGAftB55noSm1gjg2IYe/lC6h:oKEdN+5Pjh5ydgbSnBA0gjg2IYxTAveS
TLSH	T17CF4233FBF0F8AF2A7DB16E625D379F5FA6300507584A32751A25CA81433C95823E4B6
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	Neshta rar RFQ ZA

cocaman

Malicious email (T1566.001)
From: "fesseha@eri-rwanda.com" (likely spoofed)
Received: "from eri-rwanda.com (unknown [107.173.177.148]) "
Date: "15 Apr 2025 21:02:01 +0200"
Subject: "RE: purchase order RFQ-HL51L05..."
Attachment: "RFQ-HL51L05...rar.ZA"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO#RFQ-HL51L05....exe
File size:	878'592 bytes
SHA256 hash:	4d934eff240fdf3c222505a546d8fb8c682a3affb70e4a85c635f607a47d8b1a
MD5 hash:	c98f8cb0f627f8d8859acf950b145eab
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67fe6f17d6e7c3effad380e9

Tags:

installer dropper corrupt neshta

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67fe6e28e9c1e2579799d729/reports/82ddb2a9-d371-4ae2-b005-60cd9a2b4c88/overview

Verdict:

Malicious

Labled as:

Trojan.Agent

Link:

https://www.hybrid-analysis.com/sample/ef963f69e02cbc0bdb2b4fd7d152780a5926f4bab8e679d0221bcb260132e191

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ef963f69e02cbc0bdb2b4fd7d152780a5926f4bab8e679d0221bcb260132e191/

Threat name:

Win32.Trojan.Zmutzy

Status:

Malicious

First seen:

2025-04-14 19:19:29 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=56ld62pafs6axwzlj7l5cutybjmsn5f2xdthtubcdpfsmajs4giq._file

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta discovery persistence spyware stealer

Link:

https://tria.ge/reports/250415-sdjl8swls7/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Checks computer location settings

Modifies system executable filetype association

Reads user/profile data of web browsers

Detect Neshta payload

Neshta

Neshta family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ef963f69e02cbc0bdb2b4fd7d152780a5926f4bab8e679d0221bcb260132e191

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	MALWARE_Win_Neshta Create hunting rule
Author:	ditekSHen
Description:	Detects Neshta

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	neshta_v1 Create hunting rule
Author:	RandomMalware

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Virus_Neshta_2a5a14c8 Create hunting rule
Author:	Elastic Security

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator