Neshta

Family profile

Neshta is a long-standing Windows file-infector virus first seen in the early 2000s that infects executable files by prepending its own code while also overwriting the beginning of the host file and storing displaced original bytes at the end. Because it does not merely append or prepend data cleanly, remediation is more complex than simply stripping a viral stub. When an infected executable is launched, Neshta reconstructs the original host in a temporary directory and executes that clean copy to reduce user suspicion, while also maintaining its own execution path on the system.

Neshta establishes persistence by dropping a copy of itself under the Windows directory and hijacking the executable file open command so that it runs whenever a user starts an EXE file. It also creates a mutex to avoid multiple concurrent instances. The malware enumerates local, removable, and mapped network drives and infects additional executable files, while skipping some system and program directories and applying size-based checks to candidate files. It can clear read-only attributes on target files before infection.

Neshta is notable as a classic file infector rather than a modern modular payload family, but it continues to appear in contemporary intrusions as both a persistence mechanism and a delivery vehicle for other malware. It has been observed alongside ransomware and other crimeware operations, including use as a dropper for HardBit 4.0, presence in Vice Society-related incidents, and deployment in phishing-driven campaigns attributed to Red Akodon. It has also appeared in infrastructure associated with other malware operations. Although not regarded as especially advanced in terms of polymorphism or metamorphism, Neshta remains operationally relevant because its infection method complicates cleanup and can facilitate execution of secondary malicious payloads across Windows environments.

Capabilities

Defense Evasion
Lateral Movement
Persistence

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Aug 23

Aug 28

Observed infrastructure

Last seven days

First activity: Aug 23, 2026
Last activity: Aug 29, 2026
Feed role: C2 / Distribution
Host form: 4 IP / 4 hostnames

Leading locations

Leading providers

FEMO IT SOLUTIONS LIMITED3
Amazon.com, Inc.1
Cloudflare, Inc.1
Enix Ltd1
euNetworks GmbH1
Yelles AB1

Infrastructure traits

Hosting 8
Anycast 2

Samples

Recent associated samples

1c7392bc3b8c7ee38b6563381417eb199bb6fc66927cadc46dfea32a621f815e

Observed Aug 29, 2026Triage

2b5d69727d803b9c8696e39a070a983dd3883ba67829e6532c2484cd73c77ab2

Observed Aug 29, 2026Triage

373fee7150b0c3a9d7a5996313b286720aa60ef9bc7def74e64784cd428a8e42

Observed Aug 29, 2026Triage

44c33dff72ec9d8cc004622e6292a48383932fe6536bf96d58629c032d1a3a9a

Observed Aug 29, 2026Triage

c1c15fdbd45c70a2832107abc8a68a2d279834093f03dec10cbc4673052271bf

Observed Aug 29, 2026Triage

063fb02a19adefb88a47ade0eba990288e2e761f962b9fd202f286c35d579778

Observed Aug 29, 2026Triage

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Observed Aug 29, 2026Triage

5a883a62bed5110c9a347c5b9cf2f779a01c6ee9155be6c87bc2e7495e08a7d3

Observed Aug 29, 2026Triage

65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac

Observed Aug 29, 2026Triage

7ad69e000cd4f0854fd444a4973da7d14db8d86103394d267efb9f96323ca263

Observed Aug 29, 2026Triage

Reported operators

Threat actors

1 named in public reporting

Red Akodon

...artifacts... contain the Neshta malware. This malware aims to modify sections of an executable file and load malicious code.

Exploited software

Vulnerabilities linked to Neshta

1 CVEs

CVE-2018-8453 Win32k Elevation of Privilege Vulnerability

MITRE ATT&CK

Neshta in ATT&CK

18 distinct techniques

Techniques

18 techniques

T1083 File and Directory Discovery T1070.004 File Deletion T1543 Create or Modify System Process T1091 Replication Through Removable Media T1218 System Binary Proxy Execution T1574.001 DLL T1112 Modify Registry T1129 Shared Modules T1135 Network Share Discovery T1486 Data Encrypted for Impact T1068 Exploitation for Privilege Escalation T1071 Application Layer Protocol T1567 Exfiltration Over Web Service T1547.001 Registry Run Keys / Startup Folder T1204 User Execution T1105 Ingress Tool Transfer T1036 Masquerading T1059.003 Windows Command Shell

Reporting

Research mentioning Neshta

Aug 15

Github Web

GitHub - tjnel/certgraveyard_yara: Automated YARA rule generation from the Cert Central compromised certificate database. · GitHub

A public project called CertGraveyard has expanded efforts to document abused code-signing certificates used to sign malware, building a shared record of certificate abuse and helping defenders trigger revocations with certificate authorities. The project’s creator said the initiative grew out of years of reporting malicious certificates tied to malware such as SolarMarker, and has helped report more than 2,000 certificates, later growing to roughly 2,400 entries in the database. Supporting tooling includes certReport, which automates abuse reports from malware hashes using sources such as VirusTotal and MalwareBazaar, plus an API, downloadable datasets, feeds, hunting queries, and integrations with platforms including MalwareBazaar, UnpacMe, Malcat, MagicSword.io, and WDAC enforcement workflows. The database reflects a broader pattern in which threat actors repeatedly obtain or abuse valid Authenticode certificates to make malware appear trustworthy, reduce Windows warnings, and sustain delivery campaigns. Prior reporting cited SolarMarker cycling through impostor-issued certificates, FakeBat distributing signed MSI and MSIX installers, Netbounce using valid certificates and fake software branding, Dark Caracal signing Bandook variants with legitimate certificates, and Operation Red Signature abusing a stolen vendor certificate in a supply-chain intrusion. CertGraveyard’s operator said certificate authorities often act on external reports within hours, making revocation a practical disruption measure, though the project has also faced operational pressure including a major DDoS attack while handling heavy daily lookup and download volumes from defenders and malware-analysis integrations.

Jul 28

Sekoia