Overview

overview

10

Static

static

10

2025-04-15...ta.exe

windows10-2004-x64

10

2025-04-15...ta.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-15_b67d6e19b505adfd94c18ade376f0b38_black-basta_elex_neshta

  • Size

    3.8MB

  • Sample

    250415-q8lnzayybx

  • MD5

    b67d6e19b505adfd94c18ade376f0b38

  • SHA1

    2d0f379500e7198b35af84790ad460b624283c2f

  • SHA256

    425f91bf75dbd80b6ddbcaf95d817ac465f1e9e97c02621f12d00ab3aae4736c

  • SHA512

    99643f5b883d0ebb72682583034ed857eaf35a5e7cc735df7a32a855671374fe74066358df3277c74e8bfbb52aed9c1e218cc937ccc85d32beb8f41259c6dfad

  • SSDEEP

    49152:BWL+7HdMFNxOSlJtmEwZ5b3ULrV0oSt796TdXcvgyjYRTvhA:PPSlSovder

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      2025-04-15_b67d6e19b505adfd94c18ade376f0b38_black-basta_elex_neshta

    • Size

      3.8MB

    • MD5

      b67d6e19b505adfd94c18ade376f0b38

    • SHA1

      2d0f379500e7198b35af84790ad460b624283c2f

    • SHA256

      425f91bf75dbd80b6ddbcaf95d817ac465f1e9e97c02621f12d00ab3aae4736c

    • SHA512

      99643f5b883d0ebb72682583034ed857eaf35a5e7cc735df7a32a855671374fe74066358df3277c74e8bfbb52aed9c1e218cc937ccc85d32beb8f41259c6dfad

    • SSDEEP

      49152:BWL+7HdMFNxOSlJtmEwZ5b3ULrV0oSt796TdXcvgyjYRTvhA:PPSlSovder

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks