Overview

overview

10

Static

static

10

2025-04-15...ta.exe

windows10-2004-x64

10

2025-04-15...ta.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-15_73625a9b5a58ff4eba3d800aa717ba4c_black-basta_cobalt-strike_elex_neshta

  • Size

    389KB

  • Sample

    250415-nsdmbatjx2

  • MD5

    73625a9b5a58ff4eba3d800aa717ba4c

  • SHA1

    a32726b42671b382e9e3ee829fe505a36bb3f30b

  • SHA256

    50b01323bbe30790240291bd643e7e8609cebbf4dcb7bcc27a528900ec82700c

  • SHA512

    9bf7210b311e57147fa6d63ddc94169c7d3a7af6f5741ed03a640839beb22e8710264e769a6f79809e6a27139d5f640f488634b5a43f3d18fa30232133bf35fd

  • SSDEEP

    6144:k9WPEy3M+6qDQtUuT8QcZ2/t5YRLEcAB2ohC0NOlcAKorTHUWPVZ:hsy3VDAUuT8QQ2rYCB2oRAKyUSZ

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      2025-04-15_73625a9b5a58ff4eba3d800aa717ba4c_black-basta_cobalt-strike_elex_neshta

    • Size

      389KB

    • MD5

      73625a9b5a58ff4eba3d800aa717ba4c

    • SHA1

      a32726b42671b382e9e3ee829fe505a36bb3f30b

    • SHA256

      50b01323bbe30790240291bd643e7e8609cebbf4dcb7bcc27a528900ec82700c

    • SHA512

      9bf7210b311e57147fa6d63ddc94169c7d3a7af6f5741ed03a640839beb22e8710264e769a6f79809e6a27139d5f640f488634b5a43f3d18fa30232133bf35fd

    • SSDEEP

      6144:k9WPEy3M+6qDQtUuT8QcZ2/t5YRLEcAB2ohC0NOlcAKorTHUWPVZ:hsy3VDAUuT8QQ2rYCB2oRAKyUSZ

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks