neshta | 2bc24b8f0e66b74ea541ab8106809352a3b415ae442fa3d5fa278f5b1b861636

General

Target
2026-08-24_b39072ac8d9e22b08f2083e195f32c80_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 5.1MB
Sample260825-d78e5awfmg
SHA256 2bc24b8f0e66b74ea541ab8106809352a3b415ae442fa3d5fa278f5b1b861636
MD5 b39072ac8d9e22b08f2083e195f32c80
SHA1 f21d3aaa7f3a6eb82307bb672cd0bd53a47b7000
SHA512 bfc8a540f55bdf9db15cdd6dd38bb9968aa9498e1b2789e0324c4f4a7c4c81d7127d7a4e8840958e49713a0052075892ba9c443e21538785b82db0c1d9cc1175
SSDEEP 98304:+NaEhW+Q8ECNgWYh4ryBsIufILdV4BcaZRdYK0:+NaqQ8EogferyBspEdKCajqK
TLSH
T173463342B6D1C0B0E4BE10B511668B364F3A7D359BB9C0E79FD07D1DAE306D16A3628E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-24_b39072ac8d9e22b08f2083e195f32c80_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 5.1MB
- SHA256 2bc24b8f0e66b74ea541ab8106809352a3b415ae442fa3d5fa278f5b1b861636
- MD5 b39072ac8d9e22b08f2083e195f32c80
- SHA1 f21d3aaa7f3a6eb82307bb672cd0bd53a47b7000
- SHA512 bfc8a540f55bdf9db15cdd6dd38bb9968aa9498e1b2789e0324c4f4a7c4c81d7127d7a4e8840958e49713a0052075892ba9c443e21538785b82db0c1d9cc1175
- SSDEEP 98304:+NaEhW+Q8ECNgWYh4ryBsIufILdV4BcaZRdYK0:+NaqQ8EogferyBspEdKCajqK
- TLSH
  T173463342B6D1C0B0E4BE10B511668B364F3A7D359BB9C0E79FD07D1DAE306D16A3628E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution neshta persistence ransomware spyware stealer trojan upx
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- UPX dump on OEP (original entry point)
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2