MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f30ba0f23a0f23c081e138b3c62f9ecdf64dd117b590ffa25f901716a2c2c138. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 7

Intelligence 7 IOCs YARA 11 File information Comments

SHA256 hash:	f30ba0f23a0f23c081e138b3c62f9ecdf64dd117b590ffa25f901716a2c2c138
SHA3-384 hash:	a881d6d7881deff4671cba3e03e4ef74f7038de81e37dd4564343191ff30a05d49e6fccb837eccf1c95ded70ee227488
SHA1 hash:	fc479172a946af2c42fdfac37317515f3aa6d49a
MD5 hash:	0e3a530d7797bed9543b5ef0942ff274
humanhash:	london-fruit-angel-grey
File name:	samples.img
Download:	download sample
Signature	Neshta Create hunting rule
File size:	1'376'256 bytes
First seen:	2024-01-18 14:46:41 UTC
Last seen:	2024-01-19 08:49:17 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	12288:krfXXHjivz4mL/ybmDw1IwjfkM8aCDwjU3qhiqxjExqMHDFACuvFd:krfDiyaDw+yMMdC2U6Dw4sDF4
TLSH	T15055F43D38BE122BE075C6B7CBE7F427F178946B3111A964A8D747994386A4234C327E
TrID	47.7% (.ISO/UDF) UDF disc image (2114500/1/6) 46.2% (.NULL) null bytes (2048000/1) 5.7% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ATN) Photoshop Action (5007/6/1) 0.0% (.ISO) ISO 9660 CD image (2545/36/1)
Reporter	cocaman
Tags:	img Neshta QUOTATION

cocaman

Malicious email (T1566.001)
From: "Alia Harunna <aliaharunna@gmail.com>" (likely spoofed)
Received: "from gmail.com (static-100-2-41-16.nycmny.fios.verizon.net [100.2.41.16]) "
Date: "18 Jan 2024 14:55:42 -0500"
Subject: "Re: Quotation Samples"
Attachment: "samples.img"

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SAMPLES.EXE
File size:	798'720 bytes
SHA256 hash:	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a
MD5 hash:	53634e768575e91e9b89543fb47dca4c
MIME type:	application/x-dosexec
Signature	Neshta

Vendor Threat Intelligence

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

SecuriteInfo.com.Win32.CrypterX-gen.10478.25748.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

context-iso packed

Link:

https://www.filescan.io/uploads/65a939e7898512c48eb19460/reports/3d71a043-91f6-4e22-9cff-82be069b7f90/overview

Verdict:

Suspicious

Labled as:

Troj/Krypt

Link:

https://www.hybrid-analysis.com/sample/f30ba0f23a0f23c081e138b3c62f9ecdf64dd117b590ffa25f901716a2c2c138

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f30ba0f23a0f23c081e138b3c62f9ecdf64dd117b590ffa25f901716a2c2c138/

Threat name:

ByteCode-MSIL.Trojan.SpyNoon

Status:

Malicious

First seen:

2024-01-18 14:46:44 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 23 (73.91%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6mf2b4r2b4r4bapbhcz4ml46zx3e3uixwwip7is7salrniwcye4a._file

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f30ba0f23a0f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Neshta

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f30ba0f23a0f23c081e138b3c62f9ecdf64dd117b590ffa25f901716a2c2c138

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	win_neshta_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator