neshta | e3d11a8365954c73128012dc69513023810144b2187ecf091b079e5f1151e4e2

General

Target
2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop
Size 5.9MB
Sample260924-epgp5adf73
SHA256 e3d11a8365954c73128012dc69513023810144b2187ecf091b079e5f1151e4e2
MD5 2b3d42ceb0786e5cf725c493544acde3
SHA1 05810ad63c55ba02e0ac336f826aab24f9b8c03c
SHA512 9e89d6cecc0acfd87d076b71858139bf9fd83441ab0f40bf758bf160e52ac4b8811d833b076fbc1d4dba405ae2c020bb7a4c726bce33ce5c69a31486f3f08809
SSDEEP 98304:HhzcE3NYLL8Al52eIP4bD18frP3wbzWFimaI7dlo4l:TdYX8AlgtgbzWFimaI7dll
TLSH
T1BE568C51BE8D8176D90B113247299F6A102EBD28773465D3B2B43E7EEC323C16D3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop
- Size 5.9MB
- SHA256 e3d11a8365954c73128012dc69513023810144b2187ecf091b079e5f1151e4e2
- MD5 2b3d42ceb0786e5cf725c493544acde3
- SHA1 05810ad63c55ba02e0ac336f826aab24f9b8c03c
- SHA512 9e89d6cecc0acfd87d076b71858139bf9fd83441ab0f40bf758bf160e52ac4b8811d833b076fbc1d4dba405ae2c020bb7a4c726bce33ce5c69a31486f3f08809
- SSDEEP 98304:HhzcE3NYLL8Al52eIP4bD18frP3wbzWFimaI7dlo4l:TdYX8AlgtgbzWFimaI7dll
- TLSH
  T1BE568C51BE8D8176D90B113247299F6A102EBD28773465D3B2B43E7EEC323C16D3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery neshta persistence spyware stealer defense_evasion trojan
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2