Extracted

• • Target

    2025-04-04_a50ac8be77193e3cc0a48e39e900a026_black-basta_neshta

  • Size

    7.6MB

  • MD5

    a50ac8be77193e3cc0a48e39e900a026

  • SHA1

    bec2da286875a017641c435bdba9bf63f63bd1d3

  • SHA256

    855baf797b6258e2a5980b68e1743ae7b3cad0e9e49b89c966813940876c18f2

  • SHA512

    36395e427c361e364765d8515f5991c862c6a5832af275b3c6ae247c304d51daf1d3668b34f510fd4f23a63b70e80f8c53c75916450ca693c207983b7af0fffb

  • SSDEEP

    196608:LOENx7QICteEroXxWVfEqlbkkwR7VTEJZFIb+RbNTSclt6C4xMZ3j:bQInEroXgfEqirRRoJZeCRJTSa4vMd

  Score

  10^/10

  neshtarevengeratnyancatrevengediscoverypersistencepyinstallerspywarestealertrojan

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1