MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Neshta

Vendor detections: 21

Intelligence 21 IOCs YARA 15 File information Comments

SHA256 hash:	fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3
SHA3-384 hash:	041ecece8b8b1547f0633159d78240dccfb4a1710086c2eb6022d3886921f3af6c557de5047050319dfd14b723705222
SHA1 hash:	0679d6e06010b7a065e5279edf2ddfc9cf37bcdc
MD5 hash:	55f9e504b16e515f588f7ac875f66723
humanhash:	september-diet-stairway-low
File name:	venvlauncher.exe
Download:	download sample
Signature	Neshta Create hunting rule
File size:	296'792 bytes
First seen:	2025-12-03 18:57:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9f4693fc0c511135129493f2161d1e86 (259 x Neshta, 15 x AgentTesla, 15 x Formbook)
ssdeep	3072:sr85Cr7rauZnBzNuy5pCkTZcpPSUywOy+3GHcuRbuAs0FNmhMn+IhNd/m366W4Iu:k9r7WuHtQUZcpf+4H0YlgJfxv
TLSH	T17D544A46769A51F0D07285348B7747E2AB3D7D211B91C68F13D07B699E3E2C0FD2AB22
TrID	89.8% (.EXE) Win32 Executable Borland Delphi 6 (262638/61) 3.5% (.EXE) Win64 Executable (generic) (10522/11/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.5% (.EXE) Win32 Executable (generic) (4504/4/1) 0.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
dhash icon	82bac4a63828e2c0 (2 x Neshta)
Reporter	aachum
Tags:	exe Neshta

iamaachum

https://acuewghie.pro/ => https://www.mediafire.com/file/shwn0ofp84feslx/D0WN10AD_SETUP_PAS5_(2025)_F1LE.zip/file

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Neshta

Details

Neshta

an extracted component and decrypted strings

Link:

https://research.acce.ciphertechsolutions.com/results/41237555-eea8-43d5-8c37-7e86635344c1/

Malware family:

n/a

ID:

File name:

venvlauncher.exe

Verdict:

Malicious activity

Analysis date:

2025-12-03 18:58:51 UTC

Tags:

neshta python

Link:

https://app.any.run/tasks/1d7e6ab0-d4d7-464b-b02e-2c0297589fb2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Neshta

Link:

https://www.capesandbox.com/analysis/42352/

Detection(s):

Win.Trojan.Neshuta-1

Win.Virus.Neshta-7101689-0

SecuriteInfo.com.Win32.HLLP.Neshta.UNOFFICIAL

Win.Trojan.Neshta-160

Win.Trojan.Neshta-153

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6930881316e6db515e466620

Tags:

injection dropper neshta obfusc

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a file in the Windows directory

Creating a process from a recently created file

Modifying an executable file

Creating a file in the Program Files subdirectories

Creating a file

Enabling autorun with the shell\open\command registry branches

Infecting executable files

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

borland_delphi fingerprint neshta overlay overlay packed virus winlock

Link:

https://www.filescan.io/uploads/6930880f856673a0547df287/reports/d59e2e26-8c50-49b1-8917-edddfa5028e7/overview

Verdict:

Malicious

Labled as:

Neshta.A

Link:

https://www.hybrid-analysis.com/sample/fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-23T00:41:00Z UTC

Last seen:

2025-12-05T16:43:00Z UTC

Hits:

~100

Detections:

HEUR:Virus.Win32.Infector Virus.Win32.Neshta.a Trojan.Win32.Gorgon.sb HEUR:Worm.Win32.Generic Trojan-PSW.Win32.Stealer.sb BSS:Trojan.Win32.Generic UDS:DangerousObject.Multi.Generic PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3/results?tab=lookup

Malware family:

Neshta

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2acc928a-cca3-4c18-bedf-ad0555866e46

Result

Threat name:

Neshta

Detection:

malicious

Classification:

spre.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1825734

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Creates an undocumented autostart registry key

Drops executable to a common third party application directory

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Drops PE files with a suspicious file extension

Infects executable files (exe, dll, sys, html)

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Neshta

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/55f9e504b16e515f588f7ac875f66723

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3/

Verdict:

Malicious

Threat:

Family.NESHTA

Link:

https://tip.neiki.dev/file/fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3

Threat name:

Win32.Virus.Neshta

Status:

Malicious

First seen:

2025-12-01 13:22:14 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

35 of 36 (97.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ndljl7m7edhijbs5suazojg6ljruige4dywfdm4scpcrp5kaljq._file

Verdict:

malicious

Label(s):

neshta

Similar samples:

error

Neshta

Result

Malware family:

neshta

Score:

10/10

Tags:

family:neshta discovery persistence spyware stealer

Link:

https://tria.ge/reports/251203-xl3sassqds/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Checks computer location settings

Executes dropped EXE

Modifies system executable filetype association

Reads user/profile data of web browsers

Detect Neshta payload

Neshta

Neshta family

Verdict:

Malicious

Tags:

trojan neshta Win.Trojan.Neshuta-1

YARA:

EXE_Virus_Neshta_March2024 Windows_Virus_Neshta_2a5a14c8 MAL_Neshta_Generic MALWARE_Win_Neshta MAL_Malware_Imphash_Mar23_1

Link:

https://app.threat.zone/submission/5f3ff891-50d7-4f89-b933-1a422ad27418

Unpacked files

SH256 hash:

fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3

MD5 hash:

55f9e504b16e515f588f7ac875f66723

SHA1 hash:

0679d6e06010b7a065e5279edf2ddfc9cf37bcdc

Detections:

win_neshta_g0

Neshta

Link:

https://www.unpac.me/results/6645ef21-1881-4fda-b2f7-2827fccbf081/

Malware family:

Neshta

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fb46b4afecf9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	EXE_Virus_Neshta_March2024 Create hunting rule
Author:	Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_Neshta Create hunting rule
Author:	ditekSHen
Description:	Detects Neshta

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	MAL_Neshta_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	MAL_Neshta_Generic_RID2DC9 Create hunting rule
Author:	Florian Roth
Description:	Detects Neshta malware
Reference:	Internal Research

Rule name:	neshta_v1 Create hunting rule
Author:	RandomMalware

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Windows_Virus_Neshta_2a5a14c8 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Neshta

exe fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3

(this sample)

Link

https://tria.ge/251203-xd65rafl31/behavioral2

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/42352/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample