Overview

overview

10

Static

static

10

2025-04-21...ta.exe

windows10-2004-x64

10

2025-04-21...ta.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2025-04-21_97150d47ea7779101be6582fc329c2cd_black-basta_cobalt-strike_elex_luca-stealer_neshta
  • Size 760KB
  • Sample250421-mx91msvlw6
  • SHA256 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
neshtavanhelsingcredential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\readme.txt

Ransom Note
  • --= No news is a good news ! =-- Your network has been breached and all your files Personal data, financial reports and important documents has been stolen , encrypted and ready to publish to public, if you willing to continue your bussines and make more money and keep bussines secret safe you need to restore your files first, And to restore all your files you have to pay the ransom in Bitcoin. don't bother your self and wast your time or make it more harder on your bussines , we developed a locker that can't be decrypted using third part decrypters . making your self geek and trying to restore the files with third part decrypter this will leads to lose all your date ! and then the even you pay the ransom can't help you to restore your files even us. to chat with us : 1 - Download tor browser https://www.torproject.org/download/ 2 - go to one of these links above http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion 3 - you will be asked for your ticket id to enter the chat this for you : TICKET ID 6994669932656897989 usefull links : #OUR TOR BLOG : http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion
URLs

  • http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion

  • http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion

  • http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion

  • http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion

  • http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion

  • http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion

  • http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

Targets

    • Target
      2025-04-21_97150d47ea7779101be6582fc329c2cd_black-basta_cobalt-strike_elex_luca-stealer_neshta
    • Size 760KB
    • SHA256 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    neshtavanhelsingcredential_accessdiscoverypersistenceransomwarespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • VanHelsing

      VanHelsing ransomware was first observed in March 2025.

      ransomwarevanhelsing

    • Vanhelsing family

      vanhelsing

    • Renames multiple (9228) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks