Neshta
Neshta is a long-standing Windows file-infector virus, described in the content as active since 2003. Its core behavior is to infect executable files by modifying sections of PE files and loading malicious code, and it establishes persistence by hijacking executable launch behavior through the registry, specifically HKLM\SOFTWARE\Classes\exefile\shell\open\command, with observed values such as %SystemRoot%\svchost.com "%1" %*. In observed intrusions, Neshta was stored as C:\Windows\svchost.com, copied itself as a hidden file, and caused original executables to be copied to temporary locations while ensuring code execution whenever EXE files are opened.
The malware appears in multiple operational contexts as both a standalone file infector and as a delivery/persistence mechanism for other malware. It was repeatedly observed alongside Vice Society ransomware activity, where Trend Micro noted the presence of the Neshta file infector during many detections, although the exact introduction vector was unclear. In a Windows cryptomining intrusion, a self-extracting archive (sqlsupdater.sfx.exe) appeared to include Neshta for persistence, alongside NSSM-managed services and scheduled tasks, supporting deployment of an XMRig-based Monero miner. In SCILabs reporting on the Red Akodon threat actor, Neshta was used in phishing-driven campaigns targeting Colombia, where it infected executables and established execution-on-EXE-launch behavior as part of a broader infection chain involving AsyncRAT, RemcosRAT, QuasarRAT, and XWorm. Picus Security also reported that HardBit 4.0 ransomware distribution relied on Neshta as a dropper mechanism: Neshta extracted, decrypted, and launched the HardBit payload from memory offsets while also modifying registry keys for persistence.
Associated actors and malware ecosystems mentioned in the content include Vice Society, Red Akodon, HardBit 4.0 operators, and MuddyWater, whose toolset listing also included the Neshta virus. Targeting reflected the campaigns in which Neshta was embedded rather than a single intrinsic victimology: manufacturing, education, healthcare, and virtualized environments in Vice Society cases; Colombian users and organizations, especially government/judicial-themed phishing victims, in Red Akodon campaigns; and victims exposed via brute-forced RDP/SMB in HardBit 4.0 operations.
High-confidence indicators and artifacts directly mentioned include the registry persistence path HKLM\SOFTWARE\Classes\exefile\shell\open\command, the persistence value %SystemRoot%\svchost.com "%1" %*, the file path C:\Windows\svchost.com, and the sqlsupdater.sfx.exe archive observed in the cryptomining case. Overall, the content characterizes Neshta as a legacy file-infector repurposed in modern operations for persistence and as a dropper or enabler for ransomware, RAT, and cryptomining payloads.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...artifacts... contain the Neshta malware. This malware aims to modify sections of an executable file and load malicious code.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
2 techniquesPersistence
2 techniques“creates a registry key that tells the system to run the Neshta artifact every time an EXE-type file is opened.”
Privilege Escalation
1 techniqueStealth
1 technique“artifacts which seem to be legitimate files but contain the Neshta malware… stored in C:\Windows with the name svchost.com”
Defense Impairment
1 techniqueCommand and Control
1 technique“they are redirected to a Google Drive or OneDrive repository… contains a URL for downloading an additional file… If the user clicks… the download of a .zip-type compressed file from a GitHub repository begins.”
Exfiltration
1 technique“redirected to a Google Drive or OneDrive repository… download… from a GitHub repository”
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation identified as sharing the Babuk-derived codebase discussed in the article.
File-infecting virus originally discovered in 2003, now repurposed as a dropper to deliver and execute HardBit 4.0 ransomware. Modifies executables and establishes persistence via registry manipulation.
A file infector virus used by MuddyWater.
File infector observed on affected systems during Vice Society incidents, though the report states its role in the intrusion was unclear.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.