neshta | 220a3e3086526f63f24de160f9e8dc868e945c2d9d0b2224e258a2ca0204af4d

General

Target
2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop
Size 6.0MB
Sample260924-dpc69scf96
SHA256 220a3e3086526f63f24de160f9e8dc868e945c2d9d0b2224e258a2ca0204af4d
MD5 ac17bcaac507c97928e980fa1dc3a4ab
SHA1 5a685619ca266271ea36416a56cb23a6262b9460
SHA512 5b6c8fb6b9c9338abebe9ea3a5af9b175d1ee08199b7dd4d30bf61990dae96f1b13fed22a1f02a0e8eeaa7d4278180e5c81dd837199b86e30e1863d907fe8d2e
SSDEEP 98304:WyYhHtf+NA9XuAqqP4C18frP3wbzWFimaI7dlo5gq:QHF+NA9XupVgbzWFimaI7dlvq
TLSH
T149569D51BE4D8176D90B1172472D9F2A102ABD287B3865D3B2B43E7EEC323C16D3961B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop
- Size 6.0MB
- SHA256 220a3e3086526f63f24de160f9e8dc868e945c2d9d0b2224e258a2ca0204af4d
- MD5 ac17bcaac507c97928e980fa1dc3a4ab
- SHA1 5a685619ca266271ea36416a56cb23a6262b9460
- SHA512 5b6c8fb6b9c9338abebe9ea3a5af9b175d1ee08199b7dd4d30bf61990dae96f1b13fed22a1f02a0e8eeaa7d4278180e5c81dd837199b86e30e1863d907fe8d2e
- SSDEEP 98304:WyYhHtf+NA9XuAqqP4C18frP3wbzWFimaI7dlo5gq:QHF+NA9XupVgbzWFimaI7dlvq
- TLSH
  T149569D51BE4D8176D90B1172472D9F2A102ABD287B3865D3B2B43E7EEC323C16D3961B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery neshta persistence spyware stealer defense_evasion trojan
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2