Extracted

• • Target
    2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_neshta_smoke-loader_stop
  • Size 1.7MB
  • SHA256 f6d9b78b52bb037af353d2379eab8eb0cffaf0547b71dcb026f27049ca3f3ae8
  • MD5 88561f46863f440016f81749ac6befc5
  • SHA1 cbfe6b350ff87e33956e0973d3245e34adf36e2a
  • SHA512 2ea3dd7f213d4a22831dc3436eef6003f0d72facda9609b250d75fb7f81e85a4939bf37a58cf8de05cd09a457bf53165a3c75a29898c4491102fdaa98eb6230c
  • SSDEEP 49152:zHyjtk2MYC5GDQHyjtk2MYC5GDAeE2n9n9:zmtk2almtk2aQE2n9n9
  • TLSH
    T1A3858E32F2D18437D1731A3C8C6B93A9583ABE512E38794B3BF42E4D5F3968169252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2