neshta

General

Target
2025-04-21_084deb26cd9d8eff3f972e8e0c4adfe6_amadey_black-basta_elex_luca-stealer_neshta_smoke-loader
Size 1.4MB
Sample250421-mwdaaavkx4
SHA256 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f
MD5 084deb26cd9d8eff3f972e8e0c4adfe6
SHA1 6de400edd829ef2195d09f6ae3de2fd586aefe14
SHA512 adf9b1e47e0bc9c8699f31df3b30e7b14e0884e538ca565b1b50d87d1179e1f447a15e347fcf5dbae01b8b30a1193b9e01eb299b9ce3cada331aa048af8e4796
SSDEEP 24576:e4zWHoN+fFqqPuD6Iedm2q3QKtgNIGqvKD9McwPDCkw6Bh0lhSMXlemqth5yRX3K:eo5+fFqgdh02q3ntgNLqw9nwPDC7bODB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\README.txt

Ransom Note

--= No news is a good news ! =-- Your network has been breached and all your files Personal data, financial reports and important documents has been stolen , encrypted and ready to publish to public, if you willing to continue your bussines and make more money and keep bussines secret safe you need to restore your files first, And to restore all your files you have to pay the ransom in Bitcoin. don't bother your self and wast your time or make it more harder on your bussines , we developed a locker that can't be decrypted using third part decrypters . making your self geek and trying to restore the files with third part decrypter this will leads to lose all your date ! and then the even you pay the ransom can't help you to restore your files even us. to chat with us : 1 - Download tor browser https://www.torproject.org/download/ 2 - go to one of these links above http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion 3 - you will be asked for your ticket id to enter the chat this for you : TICKET ID 77565753618715415149 usefull links : #OUR TOR BLOG : http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

URLs

http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion
http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion
http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion
http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion
http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion
http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion
http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

Targets

- Target
  2025-04-21_084deb26cd9d8eff3f972e8e0c4adfe6_amadey_black-basta_elex_luca-stealer_neshta_smoke-loader
- Size 1.4MB
- SHA256 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f
- MD5 084deb26cd9d8eff3f972e8e0c4adfe6
- SHA1 6de400edd829ef2195d09f6ae3de2fd586aefe14
- SHA512 adf9b1e47e0bc9c8699f31df3b30e7b14e0884e538ca565b1b50d87d1179e1f447a15e347fcf5dbae01b8b30a1193b9e01eb299b9ce3cada331aa048af8e4796
- SSDEEP 24576:e4zWHoN+fFqqPuD6Iedm2q3QKtgNIGqvKD9McwPDCkw6Bh0lhSMXlemqth5yRX3K:eo5+fFqgdh02q3ntgNLqw9nwPDC7bODB
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

neshta vanhelsing discovery persistence ransomware spyware stealer
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- VanHelsing
  VanHelsing ransomware was first observed in March 2025.
  ransomware vanhelsing
- Vanhelsing family
  vanhelsing
- Renames multiple (260) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2