neshta | 9153dc0479aad531b282778ca0b4232703eb56a257a97647bef4ac48dfd78b64

General

Target
2026-08-10_7884a8a21ef3ba2d6d72620917a637cc_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc
Size 4.2MB
Sample260810-18ewjazemg
SHA256 9153dc0479aad531b282778ca0b4232703eb56a257a97647bef4ac48dfd78b64
MD5 7884a8a21ef3ba2d6d72620917a637cc
SHA1 e3c89fe9b1148de4e381c12dc0fcbef05b008a61
SHA512 2927d56eaf9fc8c96c6e1126e2acde9c6188ce25b34e6c7660182ea843b00e32224d1e5b830726f89db1e193c610aec778f76663a3e00bae6001c511c2d4b69e
SSDEEP 49152:qi4jF18FGhpAgYDaUabNOMm0KWZPV98WX3Mh3gcfOjp/lOSTpSS/9/:PYSarN8hz05/5
TLSH
T140265A0BA6F900F4D0BAD27ACAA79517FAB27819873197DF0651471A0F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-10_7884a8a21ef3ba2d6d72620917a637cc_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc
- Size 4.2MB
- SHA256 9153dc0479aad531b282778ca0b4232703eb56a257a97647bef4ac48dfd78b64
- MD5 7884a8a21ef3ba2d6d72620917a637cc
- SHA1 e3c89fe9b1148de4e381c12dc0fcbef05b008a61
- SHA512 2927d56eaf9fc8c96c6e1126e2acde9c6188ce25b34e6c7660182ea843b00e32224d1e5b830726f89db1e193c610aec778f76663a3e00bae6001c511c2d4b69e
- SSDEEP 49152:qi4jF18FGhpAgYDaUabNOMm0KWZPV98WX3Mh3gcfOjp/lOSTpSS/9/:PYSarN8hz05/5
- TLSH
  T140265A0BA6F900F4D0BAD27ACAA79517FAB27819873197DF0651471A0F237E09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery neshta persistence privilege_escalation spyware stealer
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2