Overview

overview

10

Static

static

10

2025-04-15...ta.exe

windows10-2004-x64

10

2025-04-15...ta.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-15_91f52c322f3fec8e774dbbf407bf45d7_black-basta_cobalt-strike_elex_luca-stealer_neshta

  • Size

    671KB

  • Sample

    250415-pgekxaxydy

  • MD5

    91f52c322f3fec8e774dbbf407bf45d7

  • SHA1

    fa14d758d3918507e9026260f8be25737625caa4

  • SHA256

    dbe02b56e5260b8cb489a4522c0d269823b3347edf8bc35950690a5805e42667

  • SHA512

    cc5debe1b7d13fccd024bec2b787c543593c7d95150b77ee1e35a437889f14c40bdcc465fd6dabcb9bb212e15ebaeace6af12cbcc1f59c7dbf8deeb841cfddd7

  • SSDEEP

    12288:bFdbJiCcoOlRhKnzh5eNE0qFu9OSxZvFMBBRhn9M:nFB5ORh6zh5eNhqU9OSRMLR/M

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      2025-04-15_91f52c322f3fec8e774dbbf407bf45d7_black-basta_cobalt-strike_elex_luca-stealer_neshta

    • Size

      671KB

    • MD5

      91f52c322f3fec8e774dbbf407bf45d7

    • SHA1

      fa14d758d3918507e9026260f8be25737625caa4

    • SHA256

      dbe02b56e5260b8cb489a4522c0d269823b3347edf8bc35950690a5805e42667

    • SHA512

      cc5debe1b7d13fccd024bec2b787c543593c7d95150b77ee1e35a437889f14c40bdcc465fd6dabcb9bb212e15ebaeace6af12cbcc1f59c7dbf8deeb841cfddd7

    • SSDEEP

      12288:bFdbJiCcoOlRhKnzh5eNE0qFu9OSxZvFMBBRhn9M:nFB5ORh6zh5eNhqU9OSRMLR/M

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks