neshta | 2c20d6613f9f70dc478c5ce88fcca9cae69f3bd70cb12586525eb22fa0b574e0

General

Target
2026-08-18_b65ee601dd104401f586170d0b471120_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc
Size 4.2MB
Sample260818-24cq2ssdla
SHA256 2c20d6613f9f70dc478c5ce88fcca9cae69f3bd70cb12586525eb22fa0b574e0
MD5 b65ee601dd104401f586170d0b471120
SHA1 3baea353143ea6dbd8e872254fbe535274609b1e
SHA512 a5f2e4c414ae7f904ef06be4d8718dbdf8a1fb3ded28e3fc9a491c25857808cc1e4e21bc6dba640823709861072feda950c56f47f598227536567e954b1e5b41
SSDEEP 49152:1oicjm1zH2U9gpxCIjmhVxG/JpcWhIMCof4YPtVWklDc5wYheKSSeBTi7Q8YqR:Tt4e0HDMk2hTJ7f1
TLSH
T19E265A1BA6B900F4D0BBD179CA679517FA72B81987319BDF0251471A4F23BE09E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_b65ee601dd104401f586170d0b471120_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc
- Size 4.2MB
- SHA256 2c20d6613f9f70dc478c5ce88fcca9cae69f3bd70cb12586525eb22fa0b574e0
- MD5 b65ee601dd104401f586170d0b471120
- SHA1 3baea353143ea6dbd8e872254fbe535274609b1e
- SHA512 a5f2e4c414ae7f904ef06be4d8718dbdf8a1fb3ded28e3fc9a491c25857808cc1e4e21bc6dba640823709861072feda950c56f47f598227536567e954b1e5b41
- SSDEEP 49152:1oicjm1zH2U9gpxCIjmhVxG/JpcWhIMCof4YPtVWklDc5wYheKSSeBTi7Q8YqR:Tt4e0HDMk2hTJ7f1
- TLSH
  T19E265A1BA6B900F4D0BBD179CA679517FA72B81987319BDF0251471A4F23BE09E3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery neshta persistence privilege_escalation spyware stealer
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2