NEW | Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool. Test it out here hunting.abuse.ch - and happy hunting 🔍

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 1b62ac8de5a24d7adbbf8d4091746eb0b1e841ff158503c4637a674cf30f448c.

Scan Results

SHA256 hash: 1b62ac8de5a24d7adbbf8d4091746eb0b1e841ff158503c4637a674cf30f448c
File size:830'480 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: b6b7ed4e53099a1d3b356cb1594f6880
SHA1 hash: ae928c7df73f29149f2d40f4430f787e069c8c3b
SHA3-384 hash: 32ba71f7bfec6355597d83589d727c5468273162ea749f87b6b665ed33db54dfff953c945cd2994b9276a08d56973f07
First seen:2022-05-05 06:54:26 UTC
Last seen:Never
Sightings:1
imphash : 9f4693fc0c511135129493f2161d1e86
Create hunting rule
ssdeep : 12288:8hKZgiENTd4UGq49lw95KJ7p/vo2YFQ1li7O7F4vcPog0JNmu1facYV2hfAob:Xyi4TUq4Pw+/tYF4iyCYxwpYV+fFb
TLSH : T1610501117AD6C031E0B6013944B6E666C67EFD22AB2499DB77CC3D4E1E385F25236363
Create hunting rule
telfhash :n/a
gimphash :n/a
File icon (PE):PE icon
dhash icon : dc5c19078ee876be
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:344632d9-cc40-11ec-949c-42010aa4000b
File name:b6b7ed4e53099a1d3b356cb1594f6880
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Adware.Amonetize-6977187-0
Create hunting rule
Signature:PUA.Win.Adware.Amonetize-6979369-0
Create hunting rule
Signature:PUA.Win.Adware.Amonetize-7170278-0
Create hunting rule
Signature:PUA.Win.Adware.Amonetize-7171482-0
Create hunting rule
Signature:PUA.Win.Adware.Amonetize-7171501-0
Create hunting rule
Signature:PUA.Win.Adware.Amonetize-7171502-0
Create hunting rule
Signature:PUA.Win.Packer.Pequake-4
Create hunting rule
Signature:Win.Packed.Zusy-9837875-0
Create hunting rule
Signature:Win.Trojan.Jadtre-5
Create hunting rule
Signature:Win.Trojan.Neshuta-1
Create hunting rule
Signature:Win.Virus.Neshta-7101689-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
TLP:TLP:WHITE
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
TLP:TLP:WHITE
Rule name:MALWARE_Win_Neshta
Create hunting rule
Author:ditekSHen
Description:Detects Neshta
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:classified
Author:classified
Description:classified
Reference:classified
TLP :TLP:GREEN

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.