neshta | 0449b48009a5048f04dead9cf5e79a661d3d92d21acbb21edf5225f44ce8f306

General

Target
2026-09-24_41acda08ce01bf456dddca38606bf4f1_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub
Size 1.6MB
Sample260924-egkrtade42
SHA256 0449b48009a5048f04dead9cf5e79a661d3d92d21acbb21edf5225f44ce8f306
MD5 41acda08ce01bf456dddca38606bf4f1
SHA1 191e9df055d93ca2e05e12439d0988c46b7d47a6
SHA512 d5fd7dce770aaaa3ce4f203a776f09f958ba04bb3e4b9fad9dc37b67e077e632ffa103387fa538f1a73d1833b44e92892169c07728aef531ec881b3c4fedcb74
SSDEEP 49152:iiGj3aPyRKCgDG2dGtIRAZ97P9T/7srCjNFKUbU:iiR3XDFGvZpP9b7O0FKUI
TLSH
T1B5851221B5E48032F2B2293046F4D6732A7DBD311B716ADB23812E5D1E35AE2E735367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_41acda08ce01bf456dddca38606bf4f1_amadey_elex_hellokitty_luca-stealer_neshta_njrat_ransomhub
- Size 1.6MB
- SHA256 0449b48009a5048f04dead9cf5e79a661d3d92d21acbb21edf5225f44ce8f306
- MD5 41acda08ce01bf456dddca38606bf4f1
- SHA1 191e9df055d93ca2e05e12439d0988c46b7d47a6
- SHA512 d5fd7dce770aaaa3ce4f203a776f09f958ba04bb3e4b9fad9dc37b67e077e632ffa103387fa538f1a73d1833b44e92892169c07728aef531ec881b3c4fedcb74
- SSDEEP 49152:iiGj3aPyRKCgDG2dGtIRAZ97P9T/7srCjNFKUbU:iiR3XDFGvZpP9b7O0FKUI
- TLSH
  T1B5851221B5E48032F2B2293046F4D6732A7DBD311B716ADB23812E5D1E35AE2E735367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery neshta persistence privilege_escalation spyware stealer defense_evasion
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2