MALICIOUS — 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
MALICIOUS — 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Neshta family. 8 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e - SHA-1:
a897f6fb6fff70c71b224caea80846bcd264cf1e - MD5:
d7d6889bfa96724f7b3f951bc06e8c02 - imphash:
9f4693fc0c511135129493f2161d1e86 - ssdeep:
98304:C/dcHQ18Jd5QgmLuqHTernf4+zo7lkckufeIP7gyA01gNQMB3FurAI6NH:dHQ+Jd52fTwf4Lxk8P7gyhenFKAIS - TLSH:
T1B865F1F48C261113DAE28E504C559C0D990F94DABEB90BADD217831FBEA13EB55702EC - Submitted as: 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
- File type: pe · Size: 5617050 bytes
- Verdict: malicious (100/100) · Family: Neshta
Detections (8 of 51 engines)
- MalwareAnalyser heuristics (entropy/packer): Turbo Linker
- ClamAV (daily): Win.Trojan.Neshuta-1
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Cyble Vision: Cyble Vision: Crimson RAT
- Detect It Easy (packer/type): DIE:Turbo Linker
- Microsoft Defender: Virus:Win32/Neshta.A
- Emsisoft (Emergency Kit): Win32.Neshta.A
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 14 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Neshuta-1 (rule
Win.Trojan.Neshuta-1) - engine signal, weight 0.90, confidence 0.95 - Cyble Vision flagged Cyble Vision: Crimson RAT (rule
Cyble Vision: Crimson RAT) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Neshta.A (rule
Virus:Win32/Neshta.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Neshta.A (rule
Win32.Neshta.A) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Extracted Neshta config (0 C2) - engine signal, weight 0.45, confidence 0.60
- YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule
DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.apple.com/DTDs/PropertyList-1.0.dtd, 185.117.73.222 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: Turbo Linker - static signal, weight 0.25, confidence 0.55
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
60791 behavior events · 2 ATT&CK techniques · 16 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- desktop-hsgcbep
- www.bing.com
- config.edge.skype.com
- aefd.nelreports.net
- dns.msftncsi.com
- watson.events.data.microsoft.com
- g.live.com
- ecs.office.com
- self.events.data.microsoft.com
- edge.microsoft.com
- www.msftncsi.com
- time.windows.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- tsfe.trafficshaping.dsp.mp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- geover.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/5173/files/b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb -
b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb - /opt/CAPEv2/storage/analyses/5173/files/9da1a55b88bda3810ccd482051dc7e0088e8539ef8da5ddd29c583f593244e1c -
9da1a55b88bda3810ccd482051dc7e0088e8539ef8da5ddd29c583f593244e1c - /opt/CAPEv2/storage/analyses/5173/files/1d226b903057fe28368936de50d0bb76313e640658c58eabc557bd19bdc99bce -
1d226b903057fe28368936de50d0bb76313e640658c58eabc557bd19bdc99bce - /opt/CAPEv2/storage/analyses/5173/files/41f3e1491356d746728a0b7ba357b18734f74484bf7030591999fba60c81d103 -
41f3e1491356d746728a0b7ba357b18734f74484bf7030591999fba60c81d103 - /opt/CAPEv2/storage/analyses/5173/files/5358f23617ee658d748c3f62bc59051a880c5b1d481387d6a7f1106be27b53ea -
5358f23617ee658d748c3f62bc59051a880c5b1d481387d6a7f1106be27b53ea - /opt/CAPEv2/storage/analyses/5173/files/c35a2c1f3b2852932a77c429c3f565b7ca858b904856fc9aef161e18c9b681f6 -
c35a2c1f3b2852932a77c429c3f565b7ca858b904856fc9aef161e18c9b681f6 - /opt/CAPEv2/storage/analyses/5173/files/3dc0511ac5ade2dda29a56a5b24a3b25d5e941828f71b6d233913e7680ea496e -
3dc0511ac5ade2dda29a56a5b24a3b25d5e941828f71b6d233913e7680ea496e - /opt/CAPEv2/storage/analyses/5173/files/d36a47ad5cbca9722bfaddd79f022fd9c114b051f348299a20a9ceab3527efc0 -
d36a47ad5cbca9722bfaddd79f022fd9c114b051f348299a20a9ceab3527efc0 - /opt/CAPEv2/storage/analyses/5173/files/e33bfbdc0e854d32a06309e12a75ac7fb05607b18c89d5bcc4c21c338e9c5ad2 -
e33bfbdc0e854d32a06309e12a75ac7fb05607b18c89d5bcc4c21c338e9c5ad2 - /opt/CAPEv2/storage/analyses/5173/files/527c7fdf2e6b092bc203ff1c7cf58c76dea70ec8944c85565f7e706c30f61aaa -
527c7fdf2e6b092bc203ff1c7cf58c76dea70ec8944c85565f7e706c30f61aaa - /opt/CAPEv2/storage/analyses/5173/files/8a045dbaa1739d18f3ad48e75b21dcc9e4e3cec96711cf5e2a2f32f22b8dccc7 -
8a045dbaa1739d18f3ad48e75b21dcc9e4e3cec96711cf5e2a2f32f22b8dccc7 - /opt/CAPEv2/storage/analyses/5173/files/f2f673e454a9b91653b4c0dbaa12bafaef2151013dc78c9235339c4ca03c48e3 -
f2f673e454a9b91653b4c0dbaa12bafaef2151013dc78c9235339c4ca03c48e3 - /opt/CAPEv2/storage/analyses/5173/files/8ba05834c4a18acb6a0862d6f75e2b97eee6a2ae67845f1dcdab492384521121 -
8ba05834c4a18acb6a0862d6f75e2b97eee6a2ae67845f1dcdab492384521121 - /opt/CAPEv2/storage/analyses/5173/files/9d92aa2267946b22b0e206384e658c3ae782ea494602db639346be8cd830f47d -
9d92aa2267946b22b0e206384e658c3ae782ea494602db639346be8cd830f47d - /opt/CAPEv2/storage/analyses/5173/files/3a04dd93ec9da19781ba97412b466452a9682a390f2cf4426f722e424465fb19 -
3a04dd93ec9da19781ba97412b466452a9682a390f2cf4426f722e424465fb19
Embedded URLs
- http://www.apple.com/DTDs/PropertyList-1.0.dtd
Embedded domains
- c.ws
- 90.gq
- www.apple.com
- aefd.nelreports.net
Embedded IP addresses
- 185.117.73.222
File paths
- C:\Users\Public\Video
- C:\Users\Public\Video\movie.mp4
- C:\Users\Public\Video\frame.exe
- V:\:b:j:p:v:~:
- C:\Users\Public\Video\hrss.exe
- C:\Users\Public\Video\lphsi.exe
- C:\ProgramData\auto.txt
- C:\ProgramData\System\Dump\
- C:\ProgramData\a.txt
- C:\Users\Public\Video\winlog.exe
- T:\:d:l:t:
- X:\:`:d:h:
- H:\:`:p:t:
- D:\:`:
- P:\]p
- I:\C9
More Neshta samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report