YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 1ddf70deaea65f0fb367c91c78b22b7e9a3eee1698ed49ce1667d3622ec5cd87.

Scan Results

SHA256 hash: 1ddf70deaea65f0fb367c91c78b22b7e9a3eee1698ed49ce1667d3622ec5cd87
File size:766'464 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 12b7c94cb3e0fc3207903bf26db0c47a
SHA1 hash: 5b046933cae5609800c260e1afa508344ad4385b
SHA3-384 hash: 777a470ac87f68fb06603408a2b1700a02002b6519584b43f6cc92b88b1076da58fd73a6d66e674ec5f2c37463faf485
First seen:2025-11-21 18:57:34 UTC
Last seen:Never
Sightings:1
imphash : 9f4693fc0c511135129493f2161d1e86
Create hunting rule
ssdeep : 6144:k9Z63sHdm890yDC4/gxgPSy+Z5u/zDFeBv2gmz7LqnQJ9SWwuXghaAColWbuBuER:YzY8ayDC4YBY/8+z77LVjogb4M0w4aNS
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 71f8fcfe98ccf079
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:f0b53808-c70b-11f0-a73e-42010aa4000b
File name:12b7c94cb3e0fc3207903bf26db0c47a
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Trojan.Jadtre-5
Create hunting rule
Signature:Win.Trojan.Neshta-153
Create hunting rule
Signature:Win.Trojan.Neshta-160
Create hunting rule
Signature:Win.Trojan.Neshuta-1
Create hunting rule
Signature:Win.Virus.Neshta-7101689-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Borland
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:EXE_Virus_Neshta_March2024
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
TLP:TLP:WHITE
Repository:YARAify
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:classified
Author:classified
Description:classified
Reference:classified
TLP :TLP:AMBER
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Neshta malware
Reference:Internal Research
TLP:TLP:WHITE
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
TLP:TLP:WHITE
Rule name:MALWARE_Win_Neshta
Create hunting rule
Author:ditekSHen
Description:Detects Neshta
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:neshta_v1
Create hunting rule
Author:RandomMalware
TLP:TLP:WHITE
Repository:YARAify
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:classified
Author:classified
Description:classified
Reference:classified
TLP :TLP:GREEN
Rule name:Windows_Virus_Neshta_2a5a14c8
Create hunting rule
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.