General
- Target 2026-06-06_601fbfa6496912b11925c444280a976a_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_stealc
- Size 770KB
- Sample260606-pyra2aev5w
- SHA256 fbaf086575c0ed883e80bdab23da2c83e95d59d281486ca1dc25dee0e242c2fd
- MD5 601fbfa6496912b11925c444280a976a
- SHA1 8c28a54ce042257e2d5d64e9b4ccd608b564bf31
- SHA512 136552c790c438903178f2f60e7649aa88c114b1e857ae465b0de42831e5195605e01b6aa570cdbcc7db4d1b43df532853b31dea68a2d5a29473aeae6591f9b8
- SSDEEP 12288:1BY5YQr/dRJen4o88v72Cno3WZ/YEH/YRw:Ln4oBvCCo34QDe
- TLSH T18FF47C16E6A401F9C0A7C17EC9578916FBB2781647609BDF13E047A62F2BAE45E3F301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-06_601fbfa6496912b11925c444280a976a_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-06_601fbfa6496912b11925c444280a976a_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_stealc.exe
Resource
win11-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-06_601fbfa6496912b11925c444280a976a_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_stealc
- Size 770KB
- SHA256 fbaf086575c0ed883e80bdab23da2c83e95d59d281486ca1dc25dee0e242c2fd
- MD5 601fbfa6496912b11925c444280a976a
- SHA1 8c28a54ce042257e2d5d64e9b4ccd608b564bf31
- SHA512 136552c790c438903178f2f60e7649aa88c114b1e857ae465b0de42831e5195605e01b6aa570cdbcc7db4d1b43df532853b31dea68a2d5a29473aeae6591f9b8
- SSDEEP 12288:1BY5YQr/dRJen4o88v72Cno3WZ/YEH/YRw:Ln4oBvCCo34QDe
- TLSH T18FF47C16E6A401F9C0A7C17EC9578916FBB2781647609BDF13E047A62F2BAE45E3F301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Modifies system executable filetype association