Hostile ^100% Download

2026-10-01_3278308ae9025abc4114d8b44ca1a213_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc

Neshta virus signature present

W32/Neshta prepending executable file infectorUnsigned WinExec payload deletes a file

SHA-2565e2cb0282ef5acb0bbce6b0e07209172f57e9a227cdd6be5dd7ea2c0c8481f4b

URLhttps://tria.ge/api/v0/samples/261002-vmsbvazglb/sample

MaleculeK(Mc)O₈(C₅Al₂As₆Dy₂Er₆I₃P₂Pr)H₁₀(Cm₁₀Cr₂Db₂DsF₇HfMgOs₁₄Po₁₁U₂)Md₃(Bi₅Si)Th₃

Evidence

Largest PE section below ten percent 0x60c0–0x6240

0x60c050a150a6400050e87cd5ffff83f8017e[email protected].|......~
0x60d0088bd392e847f8ffff5f5e5bc38d4000.....G..._^[..@.
0x60e0558bec33c055682f6d400064ff306489U..3.Uh/[email protected].
0x60f020ff058ca640007528833d90a6400000 [email protected](.=..@..
0x6100740ba190a6400050e84bd3ffffb8e890[email protected]......
0x61104000e87dc3ffffb8e4904000e873c3ff@..}[email protected]..
0x6120ff33c05a595964891068366d4000c3e9.3.ZYYd..h6m@...
0x6130fcbdffffebf85dc3832d8ca6400001c3......]..-..@...
0x6140558bec81c464ffffff53565733d28995U....d...SVW3...
0x615064ffffff8bf833c05568fc6d400064ff[email protected].
0x6160306489208d8569ffffff5068970000000d. ..i...Ph....
0x6170e81bd3ffff33dbeb5c8bf381e6ff0000.....3..\.......
0x6180008d843569ffffff50e8dad2ffff83e8...5i...P.......
0x619005743f8a843569ffffffe8edb7ffff3c.t?..5i........<
0x61a041742f8a843569ffffffe8ddb7ffff3cAt/..5i........<
0x61b042741f8d8564ffffff8a943569ffffffBt...d.....5i...
0x61c0e8efc3ffff8b9564ffffff8bc7e842c4.......d......B.
0x61d0ffff80c30433c08ac380bc0569ffffff.....3......i...
0x61e000759633c05a595964891068036e4000.u.3.ZYYd..h.n@.
0x61f08d8564ffffffe899c2ffffc3e92fbdff..d........../..
0x6200ffebed5f5e5b8be55dc38bc0558bec83..._^[..]...U...
0x6210c4f033c08945f48945f033c05568886e..3..E..E.3.Uh.n
0x6220400064ff30648920e8abe9ffffdd5df8@.d.0d. ......].
0x62309b8d45f4e8cfe1ffff8d45f4508d45f0..E.......E.P.E.
0x6240ba9c91                          ...             

GetLogicalDriveStrings API reference 0x816e–0x845e

⋯7 more rows
0x81de756c6546696c654e616d654100000000uleFileNameA....
0x81ee4765744c6f676963616c447269766553GetLogicalDriveS
0x81fe7472696e6773410000004765744c6f63tringsA...GetLoc
0x820e616c54696d65000000004765744c6173alTime....GetLas
0x821e744572726f720000000047657446696ctError....GetFil
0x822e6553697a6500000047657446696c6541eSize...GetFileA
0x823e74747269627574657341000000004765ttributesA....Ge
0x824e74447269766554797065410000004765tDriveTypeA...Ge
0x825e74436f6d6d616e644c696e6541000000tCommandLineA...
0x826e467265654c6962726172790000004669FreeLibrary...Fi
0x827e6e644e65787446696c65410000004669ndNextFileA...Fi
0x828e6e64466972737446696c654100000000ndFirstFileA....
0x829e46696e64436c6f736500000044656c65FindClose...Dele
0x82ae746546696c6541000000437265617465teFileA...Create
⋯11 more rows
0x836e64427275736800000000437265617465dBrush....Create
0x837e44494253656374696f6e000000004372DIBSection....Cr
0x838e65617465436f6d70617469626c654443eateCompatibleDC
0x839e00000000437265617465436f6d706174....CreateCompat
0x83ae69626c654269746d6170000000004269ibleBitmap....Bi
0x83be74426c7400007573657233322e646c6ctBlt..user32.dll
0x83ce0000000052656c656173654443000000....ReleaseDC...
⋯5 more rows
0x842e776572427566664100007368656c6c33werBuffA..shell3
0x843e322e646c6c0000005368656c6c4578652.dll...ShellExe
0x844e63757465410000004578747261637449cuteA...ExtractI
0x845e636f6e41000000000000000000000000conA............

Resource section entropy is unusually low 0x8dc0–0x8e90

⋯3 more rows
0x8df000000000000000000000000000000000................
0x8e0000000000358971330000000000000300....5.q3........
0x8e1003000000280000800a00000040000080....(.......@...
0x8e200e000000600000800000000035897133....`.......5.q3
⋯7 more rows

Neshta 1.0 author self-identification string 0xa060–0xa2e0

⋯7 more rows
0xa0d000000000000000000000000000000000................
0xa0e044656c7068692d74686520626573742eDelphi-the best.
0xa0f0204675636b206f666620616c6c207468 Fuck off all th
0xa1006520726573742e204e65736874612031e rest. Neshta 1
0xa1102e30204d61646520696e2042656c6172.0 Made in Belar
0xa12075732e20cff0fbe269f2e0edede520f3us. ....i..... .
0xa130f169ec207ef669eae0e2fbec7e20e1e5.i. ~.i.....~ ..
⋯5 more rows
0xa1902e20c0eb69e2e0f0fbff202d20ebe5ef. ..i..... - ...
0xa1a0f8e0e520ef69e2e02120426573742072... .i..! Best r
0xa1b0656761726473203220546f6d6d792053egards 2 Tommy S
0xa1c0616c6f2e205b4e6f762d323030355d20alo. [Nov-2005] 
0xa1d0796f757273205b447a696164756c6a61yours [Dziadulja
0xa1e0204170616e61735d0000000000000000 Apanas]........
0xa1f000000000000000000000000000000000................
⋯15 more rows

Delete files (Windows API ANSI) 0x150ac–0x152dc

⋯3 more rows
0x150dc1145e80f57c9f30f7f4df8488d95a800.E..W....M.H....
0x150ec00004883bdc000000007480f4795a800..H.......H.G...
0x150fc0000488d4de8e871c1ffff90488d4de8..H.M..q....H.M.
0x1510ce81fb9030048837f18077605488b17eb.....H....v.H...
0x1511c03488bd7488d4d08e8d7ba0300488bd8.H..H.M......H..
0x1512c48837818077603488b18488d95a80000H.x..v.H..H.....
0x1513c004883bdc000000007480f4795a80000.H.......H.G....
0x1514c00488d4c2470e8a9ba03009048837818.H.L$p......H.x.
0x1515c077603488b004c8d3dd76133004c89bd.v.H..L.=.a3.L..
0x1516cd8000000be0c00000089b5d000000048...............H
0x1517c8985e00000004885c07408488bc8e80d......H..t.H....
0x1518cf70e00488985e80000004c8d258b6133...H......L.%.a3
0x1519c004c89a5f800000089b5f00000004889.L............H.
0x151ac9d000100004885db740a488bcbe8def6.....H..t.H.....
0x151bc0e00eb0233c048898508010000c74424....3.H.......D$
0x151cc4002000000c744243802000000c74424@.....D$8.....D$
0x151dc3001000000c7442428333c78e2488d050.....D$(3<x.H..
0x151eca85d330048894424204c8d0d5c663300.]3.H.D$ L..\f3.
0x151fc41b815040000488d15c7623300488d4dA.....H...b3.H.M
0x1520c38e83a8d0300488d95d0000000488d4d8.:...H......H.M
0x1521c38e882b4030090488d4c2470e80f32ff8......H.L$p..2.
0x1522cff90488d4d08e80532ffff488b4c2460..H.M...2..H.L$`
0x1523c48837918007501cc488b4918488b0148H.y..u..H.I.H..H
0x1524c8d95a80000004883bdc000000007480f......H.......H.
0x1525c4795a80000004c8d4da04c8d4598488bG.....L.M.L.E.H.
⋯8 more rows