neshta | e03cf9026c9a9da3fd4b3d4c4fd1153a80ba08f6a4b66973f282762dc32bebee

General

Target
2026-10-26_5e6b0acafbbfa753c4d151bcbf354d81_akira_cobalt-strike_elex_glassworm_icedid_neshta_ransomhub
Size 3.4MB
Sample261027-tst7ysvxgs
SHA256 e03cf9026c9a9da3fd4b3d4c4fd1153a80ba08f6a4b66973f282762dc32bebee
MD5 5e6b0acafbbfa753c4d151bcbf354d81
SHA1 d8cd9ca4ecbe12f087fb842f77a7dedce36b9f8e
SHA512 649b28b7235df14206bd8d4e57933610294be0f8d294e866b7fdbc9426959d6cb50dbfb7d5486e5b6f0b28f81cc59a142ae84a65fc2452e1b0891c301a24b9dc
SSDEEP 49152:MG/+YNOZXny1O6ijfEO5kygTseVpKZOONnAz2nsRjmLogIVYIU6iCAUUUUUUzJ:MG2YmX1ED9KtnWfjB9n+PUUUUUUV
TLSH
T1DFF59E43FE9585E9C0ADC43883975672AE32B88D4730B3AB1BD846217E26FD05F5D34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-26_5e6b0acafbbfa753c4d151bcbf354d81_akira_cobalt-strike_elex_glassworm_icedid_neshta_ransomhub
- Size 3.4MB
- SHA256 e03cf9026c9a9da3fd4b3d4c4fd1153a80ba08f6a4b66973f282762dc32bebee
- MD5 5e6b0acafbbfa753c4d151bcbf354d81
- SHA1 d8cd9ca4ecbe12f087fb842f77a7dedce36b9f8e
- SHA512 649b28b7235df14206bd8d4e57933610294be0f8d294e866b7fdbc9426959d6cb50dbfb7d5486e5b6f0b28f81cc59a142ae84a65fc2452e1b0891c301a24b9dc
- SSDEEP 49152:MG/+YNOZXny1O6ijfEO5kygTseVpKZOONnAz2nsRjmLogIVYIU6iCAUUUUUUzJ:MG2YmX1ED9KtnWfjB9n+PUUUUUUV
- TLSH
  T1DFF59E43FE9585E9C0ADC43883975672AE32B88D4730B3AB1BD846217E26FD05F5D34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution neshta persistence spyware stealer
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables referencing combination of virtualization drivers
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2