neshta | cba062c501d750c44f95fa8430aed2e81736d7f0d533298e436741d4f542f22f

General

Target
2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop
Size 8.1MB
Sample260809-vlyggavyct
SHA256 cba062c501d750c44f95fa8430aed2e81736d7f0d533298e436741d4f542f22f
MD5 2757cbf6761338bf0888dee222d52fad
SHA1 431182f90b0aed156c58f7a89443ec8d17e62984
SHA512 f86f2cd4b7f26a0d49d609677709f39561879f8ea7bd1b14e4f2d11c32754c3494d7febb302609e45e67268ccb0bedc6b5a5ce9d815dab076ed45944c2015a4b
SSDEEP 196608:yKAjowI127ojD390bYVW+SHHgSHHDl01f7PNdG4cx7QPPQ61BG1AsnZcsG7Ugi:xFDX1f7PNdG4cx7QPPQ61BG1AsnZcsG6
TLSH
T1AB86946770FA31E7E3D9C0F8E6629664ED8F4CF983F56B8E422804B595A1781CD6023D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop
- Size 8.1MB
- SHA256 cba062c501d750c44f95fa8430aed2e81736d7f0d533298e436741d4f542f22f
- MD5 2757cbf6761338bf0888dee222d52fad
- SHA1 431182f90b0aed156c58f7a89443ec8d17e62984
- SHA512 f86f2cd4b7f26a0d49d609677709f39561879f8ea7bd1b14e4f2d11c32754c3494d7febb302609e45e67268ccb0bedc6b5a5ce9d815dab076ed45944c2015a4b
- SSDEEP 196608:yKAjowI127ojD390bYVW+SHHgSHHDl01f7PNdG4cx7QPPQ61BG1AsnZcsG7Ugi:xFDX1f7PNdG4cx7QPPQ61BG1AsnZcsG6
- TLSH
  T1AB86946770FA31E7E3D9C0F8E6629664ED8F4CF983F56B8E422804B595A1781CD6023D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery neshta persistence spyware stealer defense_evasion trojan
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2