[ENCRYP73D_GH05T]

as per @mothered  Request

Direct VT : https://www.virustotal.com/gui/file/352e.../detection





(Just doing what was asked I dont mess with this stuff ! So again all im doing is just posting what was asked by staff)

[ConcernedCitizen]

Interesting! Can you please share what registry keys are created and modified and/or removed by the wscript? It's so fun to deobfuscate jcode and wscript, and this is the first time I've seen Neshta. I'll have to do some digging later tonight.

[ENCRYP73D_GH05T]

Interesting! Can you please share what registry keys are created and modified and/or removed by the wscript? It's so fun to deobfuscate jcode and wscript, and this is the first time I've seen Neshta. I'll have to do some digging later tonight.

Yes my Good Sir No Problem It shall be uploaded  soon and i will Tag you Name

working on braking it down instead of crappy VT Reg Info

software\microsoft\windows\currentversion\run\Sound Realtek Update

wscript.exe //B "C:\Users\<USER>\AppData\Roaming\Sound Realtek Update.JS"

HKCR\exefile\shell\open\command\

C:\Windows\svchost.com "%1" %*

Neshta can be serious just depends on which version the person is Trying to infect with it some are way stronger than others

[ConcernedCitizen]

Interesting! Can you please share what registry keys are created and modified and/or removed by the wscript? It's so fun to deobfuscate jcode and wscript, and this is the first time I've seen Neshta. I'll have to do some digging later tonight.

Yes my Good Sir No Problem It shall be uploaded  soon and i will Tag you Name

working on braking it down instead of crappy VT Reg Info

software\microsoft\windows\currentversion\run\Sound Realtek Update

wscript.exe //B "C:\Users\<USER>\AppData\Roaming\Sound Realtek Update.JS"

HKCR\exefile\shell\open\command\

C:\Windows\svchost.com "%1" %*

Neshta can be serious just depends on which version the person is Trying to infect with it some are way stronger than others

What I've found so far is that this sample utilizes both reverse backdoors and USB spreading. It attempts to use the realtek update functionality to call out any filesharing systems such as Windows SMB and FTP, to the originating malware sender. Exfiltration can be stopped by filtering traffic from high ports by default.

Thanks for the info, I'm on mobile so it's hard to get into more procmon and regkey stuff. This is a known malware so no need to report the hashes. This is not even customized code so I'm betting whoever created it probably installed a server into it as a way to attack others that use it. 😅

[ENCRYP73D_GH05T]

Interesting! Can you please share what registry keys are created and modified and/or removed by the wscript? It's so fun to deobfuscate jcode and wscript, and this is the first time I've seen Neshta. I'll have to do some digging later tonight.

Yes my Good Sir No Problem It shall be uploaded  soon and i will Tag you Name

working on braking it down instead of crappy VT Reg Info

software\microsoft\windows\currentversion\run\Sound Realtek Update

wscript.exe //B "C:\Users\<USER>\AppData\Roaming\Sound Realtek Update.JS"

HKCR\exefile\shell\open\command\

C:\Windows\svchost.com "%1" %*

Neshta can be serious just depends on which version the person is Trying to infect with it some are way stronger than others

What I've found so far is that this sample utilizes both reverse backdoors and USB spreading. It attempts to use the realtek update functionality to call out any filesharing systems such as Windows SMB and FTP, to the originating malware sender. Exfiltration can be stopped by filtering traffic from high ports by default.

Thanks for the info, I'm on mobile so it's hard to get into more procmon and regkey stuff. This is a known malware so no need to report the hashes. This is not even customized code so I'm betting whoever created it probably installed a server into it as a way to attack others that use it. 😅

Biggest crap now and days in Redline Stealer -_- although if someone actually knows what thy are doing it can be hidden extremely well and become hard to detect !
But i better shut up no need to bring anymore attention or spam to this worthless thread ! although if you dig into it more please share some finding if you have the time !
it will be interesting to find more about it !

[mothered]

Virus! destroyed my VB cant install any programs or enter task manager, windows doesn't understand what EXE file is , please delete this piece of sh*t
https://postimg.cc/gallery/XJqrRZb screenshots

with respect Keylimehat

@mothered

Thanks for bringing It to my attention.

For the safety of the community, I've removed the link.