neshta | 55d726f18ff6c6a006fa861edd7b8a7cba7534d2900daffed6c04714c54f4bb1 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

vbc.exe

windows7-x64

vbc.exe

windows10-2004-x64

7

$PLUGINSDI...yc.dll

windows7-x64

$PLUGINSDI...yc.dll

windows10-2004-x64

3

Sharing

General

Target

JaffaCakes118_55d726f18ff6c6a006fa861edd7b8a7cba7534d2900daffed6c04714c54f4bb1
Size

221KB
Sample

241224-mc88lsvlcv
MD5

8fb6bc5675ae219d908efeef4de8d836
SHA1

07d6d7aa5b07d7f728c52aebbe0aa3b6b5b37888
SHA256

55d726f18ff6c6a006fa861edd7b8a7cba7534d2900daffed6c04714c54f4bb1
SHA512

c33f7fa67317fc6bf2eaf75d8b7368071b0e59b0bb6cd6eb54a913d294c9f32755f17fa2a8381eeee8b3d8ebe06fc342c44befcd4e6aa8837daa57a62c5abc5f
SSDEEP

3072:xZlY5UvkciUDOaUipyGKCv1wfH5l5meGsP2U76c+5hE1Heti981gOxGXnvzUv9yk:uHsyMk5C6wc+PE1j981NoM

Score

10^/10

neshta discovery persistence spyware

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

vbc.exe

Resource

win7-20241010-en

neshta discovery persistence spyware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

vbc.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/azxcktqvoyc.dll

Resource

win7-20240903-en

neshta discovery persistence spyware

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/azxcktqvoyc.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  vbc.bin
- Size
  
  234KB
- MD5
  
  781932d5e3cf1b9e902ee2ea8c48f572
- SHA1
  
  70a244d771d7cfa61b2fa3d2a0ac386ea2bf0393
- SHA256
  
  afbae06f0ec7939e039a47b7579a98f269eca1be5625e7343267cf4bbb0d5709
- SHA512
  
  ba05f74a081a6e4fc12b4c00f388da141bdfa61074ecf379421cdcc72d6f546e6067e07877332e3456bf27a3b17d5549ade76b04cbf2de2753f39fbdf31082bc
- SSDEEP
  
  6144:wBlL/c42BI/9n/DNlCeLwfyYMgKoul0D8nPEAq8G:Ce4X9/bCn0kul0D8nJq8G
Score

10^/10

neshta discovery persistence spyware
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Loads dropped DLL
- Uses the VBS compiler for execution
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/azxcktqvoyc.dll
- Size
  
  32KB
- MD5
  
  26ffa4722b447fff084a239b44f7cac9
- SHA1
  
  39f7ad0bf15f3dcf6e67141108476abea370f7e3
- SHA256
  
  77aba174986d7969103ae452fd1193ccb9dc495a4579fa4b7f2939e367b33121
- SHA512
  
  118068c79e021899abeeb9a17e548b9887af536fc9b8a9a35358ef85980d31fc5192f989a4d5d1a3826c63882888cdc10ac3c5f3918a4172bbf547643ff75532
- SSDEEP
  
  384:6eyzsup6rnYbZmywovTGUuoyD2mFTDw4ujoXIlOzBplLkFzSKmW26W:6eyP6Umy5qUuo/mFX91p
Score

10^/10

neshta discovery persistence spyware
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

neshtadiscoverypersistencespyware

behavioral2

behavioral3

neshtadiscoverypersistencespyware

behavioral4

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.