Extracted

• • Target

    2025-04-04_0a235c98a2ae0703ab33070d01790a62_black-basta_neshta

  • Size

    7.6MB

  • MD5

    0a235c98a2ae0703ab33070d01790a62

  • SHA1

    755130c503e79e7e9aa3b9a98220ac25aa2a6033

  • SHA256

    e7dd777f3a63a86d7a466c3aa9796e3e3c3f2df9b761f74cc031583724cc80af

  • SHA512

    c9a4a20b5be8127e08d8979abfe25043f3b437f11b8ef381e1ffc090a77d44ea448541e762001ec2680093be8e3ece51fd0e25004f8cd0b224dce902e43e8b21

  • SSDEEP

    196608:ZOENx7QICteEroXxWVfEqlbkkwR7VTEJZFIb+RbNTSclt6C4xMZ3j:9QInEroXgfEqirRRoJZeCRJTSa4vMd

  Score

  10^/10

  neshtarevengeratnyancatrevengediscoverypersistencepyinstallerspywarestealertrojan

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1