neshta | 1261c15ed4408a6a64432739aebdd71e5f60b09ae4b457e3b9a7f3ccd23f87b8

General

Target
2026-08-24_87915ce3952042931c483f84fc385fd9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 4.5MB
Sample260825-kefb7sfr5v
SHA256 1261c15ed4408a6a64432739aebdd71e5f60b09ae4b457e3b9a7f3ccd23f87b8
MD5 87915ce3952042931c483f84fc385fd9
SHA1 c333ea2c68b6de392d790612171c6584dd0fc0af
SHA512 a1855d1286972d30d4c2bd468605c1a25c06506bc4d504a9273e0ae35bba2a8d2d9f2e47a110474ddb9069b48cf54f52a4c896e8e01a32874d135121cebf9548
SSDEEP 98304:6LFoGiDeLWw8JIlCek8ECNMns74Wntvns74Wnte0:moG94JIHk8EaMs7Jntvs7Jnte
TLSH
T1B2262302B352C031E5DB00B50561A7B98D7A7E3157B884F75FE46DA5AE30BC1BB3A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-24_87915ce3952042931c483f84fc385fd9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 4.5MB
- SHA256 1261c15ed4408a6a64432739aebdd71e5f60b09ae4b457e3b9a7f3ccd23f87b8
- MD5 87915ce3952042931c483f84fc385fd9
- SHA1 c333ea2c68b6de392d790612171c6584dd0fc0af
- SHA512 a1855d1286972d30d4c2bd468605c1a25c06506bc4d504a9273e0ae35bba2a8d2d9f2e47a110474ddb9069b48cf54f52a4c896e8e01a32874d135121cebf9548
- SSDEEP 98304:6LFoGiDeLWw8JIlCek8ECNMns74Wntvns74Wnte0:moG94JIHk8EaMs7Jntvs7Jnte
- TLSH
  T1B2262302B352C031E5DB00B50561A7B98D7A7E3157B884F75FE46DA5AE30BC1BB3A386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution neshta persistence ransomware spyware stealer trojan upx
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- UPX dump on OEP (original entry point)
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2