neshta | 25cf049f9d9d783e3d154ab370fd8962072fc38266e2075efdbe47b30b0c1835

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
Size 4.5MB
Sample261101-24dcksdx7w
SHA256 25cf049f9d9d783e3d154ab370fd8962072fc38266e2075efdbe47b30b0c1835
MD5 8c1f9052af973d7e693d036f01f31916
SHA1 6629e763a38709b2462a891386bb4457d2aea13b
SHA512 4c48c7085ddb4d57d3bf39ab836efa06d11ca62a81deec708971acc007b0760ec2c67b9f13bb1190d8902ba852f96fae6f757043aeef4d616b800402e7c6fe54
SSDEEP 98304:2iDRIul+YYXOut/F3qiyzm9XubOrAyw7DRcKg:2aZlYXnJYiyzm9e6rnw7DGB
TLSH
T17926231765A0CA36E04125768C09C3B0AF70E2B179615663F7ECDF7EEF65083DA11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral2/files/0x00090000000188ff-41.dat	family_neshta
behavioral2/memory/1360-1785-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1360-1786-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1360-1787-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1360-1789-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Executes dropped EXE 4 IoCs

pid	Process
4216	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
3624	InsydeFlash.exe
4944	iscflashx64.sys
5844	FlsHook.exe

Loads dropped DLL 2 IoCs

pid	Process
3624	InsydeFlash.exe
5844	FlsHook.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InsydeFlash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlsHook.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3624	InsydeFlash.exe
3624	InsydeFlash.exe
5844	FlsHook.exe
5844	FlsHook.exe
5844	FlsHook.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4216	1360	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe	89
PID 4216 wrote to memory of 3624	4216	2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe	90
PID 3624 wrote to memory of 5844	3624	InsydeFlash.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\InsydeFlash.exe
    .\InsydeFlash.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\FlsHook.exe
      C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\FlsHook.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5844

C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\iscflashx64.sys
C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\iscflashx64.sys
1⤵
- Executes dropped EXE
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_8c1f9052af973d7e693d036f01f31916_elex_neshta_ransomhub_stealc_stop.exe
Size 4.5MB
SHA256 84036d45fd0f1cd9065e14956fd6b44b1eb43fc89ed940de6567117840b257e9
MD5 3a613fd1a43bf5c083215e485e8ab026
SHA1 532a7404af78221924d6ecbda24f7fb38985eb47
SHA512 732dc45119bc76cf85aa7807d7d45c3225ee5848226bb4c82ccfd41bdd1e22356cc8e24ea0efd100dd5cf76fe66a93daf1897b7ce59945c9e763c96c5c261992
SSDEEP 98304:yiDRIul+YYXOut/F3qiyzm9XubOrAyw7DRcKf:yaZlYXnJYiyzm9e6rnw7DGC
TLSH
T1A926331765A0CB36E04161768C48C3B0AB70E1B179619663F7DCEF7EEF61483DA11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlsHook.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\FlsHook.exe
Size 227KB
SHA256 616ef32e71805fc03cd278ab3cc34031a1a147cff6e790f2d1ca472bdbf234d6
MD5 43e0441b26d85b6dee2efd1398c783c3
SHA1 15625331db35875a809a6b4c50fd20e7452485fc
SHA512 26381d3e34920096b65c8dc793ac45b936d103530dac796b2df13df00145a0fe26497b3a5ebc16866f100f8c510664ef56be399da5c9adae471d18530d5f4cb7
SSDEEP 6144:x4bEBZID7PD+bN5gtfM2LKzxvklDHi6Zwe5w7VAA:FsDu5gtfM2uxvF6ZwL/
TLSH
T186346D213AF1C432D1A330324A96C7797A7AB4314B35968B37D45B3D9F306E29B3835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlsHookDll.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\FlsHookDll.dll
Size 191KB
SHA256 a52cf46e26c17165a21068899c364606f8847df5deaf8e2b7ca9a35149b62466
MD5 1e73de64994da99827c93d3123b4ed15
SHA1 8e101ce4bc9d16f9347c30cc272c6d899af91eb8
SHA512 a54004fa85b2cf4b7325eb645f0c15515590f489b950c125e487e403091ad6f9734e0d8416659437ccc65f5bb21420fa38e6dd723b55f4740e5fe7ba7f2d0fad
SSDEEP 3072:qrkkJwb9oI/hNb1SCiHkggB6vBkO29qGFXIsLkQxt15IPDlYek:6wb9oI/3b1SCukGvBkjkGFYsLkQxSu
TLSH
T10114391172D0C032D2BB3679496697712BAEBC70CEB1874F3F907A6D5E316A18E29317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISCFLASH.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\ISCFLASH.dll
Size 694KB
SHA256 9fe49c7b391f5c3ae5270f645f7a3a9008eab0558ade81a9092daa84cbfc5823
MD5 cddcdbd1c7a741f40f381d18f8fe46f4
SHA1 29bd217429d2449213e5837c410e9ee44c0ba0da
SHA512 20d450e79074ad006edc84061bd1be35a6d6a550cd5fa502e2bed602ce62c1dd1a2f88fd4d2c10f5d50743bb765bac62d94ea006e7d0dcc37a89fff786a56bfe
SSDEEP 6144:vck+R6v+NrPdD5Z21FfAKjemtE/QPhbxH8Eo+IbX1A6ROk/xuTFvicGUBrAM:zv+NrlDVlEo+IbX1A6RPpQFeM
TLSH
T197E45C016BE4C131F1BF357669B68236567A7DA05735C2DB96C0F52E6EB02C2AC39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InsydeFlash.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\InsydeFlash.exe
Size 675KB
SHA256 a17fdbf728cde50993b52e9aa7d47d54e791eb108e9b1a89f3dcfedf5ec84050
MD5 8a6f4df2ff7b1689c31248eb97a7d5bb
SHA1 cc44c27da68916c6a065f4eaab01717698e56ccd
SHA512 b15bcb1ce25dfcbeef07551b777a8ae68c29a06cacb656d6539ff8cd72eee32a53acf9b94ea19f6e6c4ef01adcc21842f9c5e53e9630486c1e14bade9ae4a31d
SSDEEP 12288:XlwTL7mxFCRaBF2sXhg83guVt6heYLWzswpKrqXWOKKTw7lk2oilB8E3YViiw3ds:XlQa2GO83nVJYLWzswpKrqXWOKKTw7lU
TLSH
T13FE4185C9AE480F0F26EA532A9798FE507F53C319B24468F6EECFA1C5B316D1A834345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QCL20A20.fd

Path C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\QCL20A20.fd
Size 7.5MB
SHA256 08cebee78bfd55249f85d5eae7b3eeab04d334cbb8c03c3c8a51d9bfae04cd7e
MD5 e6e51c7037768d22774fcc122d7b2937
SHA1 963b214a5f309d682297ea4058dee009813a6d6b
SHA512 9336074daf9fcf02f3c2da2f0abadf5c7135e96e42342a8bfdaba8212d01217657a4fef858ddb55066aba903f204b95ba8bcf9143a0c3bf24724314d01cf7573
SSDEEP 98304:u5KDrbfqWaLPxwLDQqO1JS1ViFF2gqpcaBz:/vqDLRzS1oFEgq2U
TLSH
T13D762321F3E6C121E17255708ABA8211EF7B7C502930C66F339C796A6F72D83C529B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iscflashx64.sys

Path C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\iscflashx64.sys
Size 57KB
SHA256 c9f1d94677e4baa47acebaaf651972c6819d76ecbc8175d835238b0fa1a58ab7
MD5 b16b65bd32898f1172d6f14ed63c2117
SHA1 61a6089d2d7dd9890e58117142da94604d8a2176
SHA512 eef9ec0a4c35017a7e6850e308b4d0dae70869ca070b3e9a2fc9463f25eb041afab6a7df0b84f5db1d272db1ba14cb854c77c5e9a3e0783600ba9e8b8fea0ab5
SSDEEP 1536:QTNXoFBwlOHv0QVNF23LkxexMpgyIvILCvDr:QTNXoFylOPOxsyFH
TLSH
T17243F7862391103DE096E678EE954725B7B0F5CC17F8CEDF4AC18A401E093F4E67AB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\platform.ini
Size 31KB
SHA256 0cc632b3796f33ee9d59fa2d4c9e0b1a38a582ab0de7dd075557b20728b70710
MD5 733dc9ef00feb47271ff8704db0c63f5
SHA1 b3a677e132d7835a2d938344419963d4c29e3ece
SHA512 4ccf56fcb663f7c8d450700e9346b35aad1e483ccdec0271984ccc49f1c983893013d5f24377e1695eb7c33ee4f0e4fa211081eca9b1a8895cea1b73d0208692
SSDEEP 384:8DVg9rctBLakTOHLHY+/IGtilca8d8Ttb9pYBnZAr:a0rc7Lh6HLHxDa8GTthuBZAr
TLSH
T1ADE252063A0FE5774031E311A3E51503F7A44E2F676A7268748DCDB92B34819E3BE6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platforms.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS2541.tmp\platforms.ini
Size 31KB
SHA256 42dfadd43f02411267c3541fe053b58fa3af244badf20b7acbbd67d15741bc30
MD5 68d303ff153b54f9c87ef155771dba1e
SHA1 dc356269054fd5e4a307ff10e5132449ec69914e
SHA512 f5ba6e18f4334f4576900cc3309dea47eeb8c19fd94acb1b62fff8a48245a20f7fbe4522759be75724ffee0963bdfe216ee85350e12982f74e3e5aa1bea2c1fb
SSDEEP 384:cQc+TGx0tkM+mkytxThMIyix6CHIGLhdcMOD2JBkiJNSO9Q9:XcQU0mM+N20IyixDWMOyJBkiPSwQ9
TLSH
T137E253062ACFD56705F1EEC1A3E95802F7545D5A6B26726CB08CCCA81B3C81CE7AD7B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-1785-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1360-1786-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1360-1787-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1360-1789-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4216-1784-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/4944-1669-0x0000000000010000-0x0000000000022000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads