Loading malware…
Neshta is a long-standing Windows file-infector virus first seen in the early 2000s that infects executable files by prepending its own code while also overwriting the beginning of the host file and storing displaced original bytes at the end. Because it does not merely append or prepend data cleanly, remediation is more complex than simply stripping a viral stub. When an infected executable is launched, Neshta reconstructs the original host in a temporary directory and executes that clean copy to reduce user suspicion, while also maintaining its own execution path on the system.
Neshta establishes persistence by dropping a copy of itself under the Windows directory and hijacking the executable file open command so that it runs whenever a user starts an EXE file. It also creates a mutex to avoid multiple concurrent instances. The malware enumerates local, removable, and mapped network drives and infects additional executable files, while skipping some system and program directories and applying size-based checks to candidate files. It can clear read-only attributes on target files before infection.
Neshta is notable as a classic file infector rather than a modern modular payload family, but it continues to appear in contemporary intrusions as both a persistence mechanism and a delivery vehicle for other malware. It has been observed alongside ransomware and other crimeware operations, including use as a dropper for HardBit 4.0, presence in Vice Society-related incidents, and deployment in phishing-driven campaigns attributed to Red Akodon. It has also appeared in infrastructure associated with other malware operations. Although not regarded as especially advanced in terms of polymorphism or metamorphism, Neshta remains operationally relevant because its infection method complicates cleanup and can facilitate execution of secondary malicious payloads across Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Initial Sample – CVE-2018-8453 ... Kaspersky detailing how Sodin (a.k.a Sodinokibi, or REvil), an infamous ransomware, is using a 1-Day exploit for CVE-2018-8453. | CVE-2018-8453 ... Used by the following malware families: REvil (Sodinokibi), Maze, Neshta.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...artifacts... contain the Neshta malware. This malware aims to modify sections of an executable file and load malicious code.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
“install.bat… update.bat… using DACLs via icacls scripting… creates multiple scheduled tasks…”
Another pass to the decryption algorithm reveals the string ‘MutexPolesskayaGlush*.*’, which is used as the name of a mutex created using a call to the CreateMutexA API. This is used to avoid running multiple instances of the malware.
“If the user unzips and executes the contents of the previous file, the malicious activity begins.”
a system infected with Neshta will have the modified registry key ‘HKEY_CLASSES_ROOT\exefile\shell\open\command’ with ‘C:\WINDOWS\svchost.com "%1" %*’. Since C:\WINDOWS\svchost.com is the virus itself, an application will run, with the virus becoming the parent process and the .exe file the child process.
it opens the registry key ‘HKEY_CLASSES_ROOT\exefile\shell\open\command’ using the RegOpenKeyExA API... setting the registry key ‘HKEY_CLASSES_ROOT\exefile\shell\open\command’ with ‘C:\WINDOWS\svchost.com "%1" %*’ as the data value using the RegSetValueExA API.
All of the exploits that we found related to this actor were 1-Day exploits for Local Privilege Escalation (LPE) vulnerabilities in Windows.
“artifacts which seem to be legitimate files but contain the Neshta malware… stored in C:\Windows with the name svchost.com”
the malware attempts to list all the files found in the ‘%temp%\3582-490\’ folder, and tries to delete them one by one, using the DeleteFileA API.
Neshta executes the host file from the ‘%temp%\3582-490\’ folder to avoid raising suspicion that the file is infected, using a call to the ShellExecuteA API.
a system infected with Neshta will have the modified registry key ‘HKEY_CLASSES_ROOT\exefile\shell\open\command’ with ‘C:\WINDOWS\svchost.com "%1" %*’. Since C:\WINDOWS\svchost.com is the virus itself, an application will run, with the virus becoming the parent process and the .exe file the child process.
Using a combination of the FindFirstFileA and FindNextFileA APIs, the malware attempts to list all the files found in the ‘%temp%\3582-490\’ folder... Neshta searches for available drives for infection. It lists the available logical drives in the system using the GetLogicalDriveStringsA API... The malware traverses each folder in each drive searching for executable files for possible infection.
Using the encryption/decryption algorithm discussed earlier, the malware encrypts the first 1,000 (0x3E8) bytes of the recently read data... The data written at the end of the host file includes the newly encrypted 1,000 header bytes and the rest of the first 41,472 (0xA200) bytes of the victim file.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation identified as sharing the Babuk-derived codebase discussed in the article.
File-infecting virus originally discovered in 2003, now repurposed as a dropper to deliver and execute HardBit 4.0 ransomware. Modifies executables and establishes persistence via registry manipulation.
A file infector virus used by MuddyWater.
Mentioned only because an alert labeled activity as related to a Neshta variant during sandbox execution of one EXE payload.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.