Extracted

• • Target

    2025-03-30_a2b6b00c9d611b99e47068506941fa31_amadey_black-basta_darkgate_hijackloader_luca-stealer_neshta_smoke-loader

  • Size

    7.8MB

  • MD5

    a2b6b00c9d611b99e47068506941fa31

  • SHA1

    eadf765375639ba78ee98048aa61ef519efb757e

  • SHA256

    e2e888f5e0dec43e08cdfe000040307b32dba99431d00337b69002cadbb1acae

  • SHA512

    6b5ba15df2ef49a7b9564dade3e023119d00e7208bf59586e0e584d95e610d964e509e752f7f1e524fbdc447b27938bc6074255f4f0f3596652ae996f754816a

  • SSDEEP

    98304:Gnsmtk2a0mtk2aUmtk2aPxOpcjacR2lqxZA1pm2KMhSpo1jgPnQng:4Li69NlqxWpm2KM0sKug

  Score

  10^/10

  neshtaxredbackdoordiscoverypersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2