Extracted

Extracted

• • Target
    2026-05-28_226747848bcc19281397f948c7d13d0e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
  • Size 3.1MB
  • SHA256 f42affc6da97fefa7e727cbea7f5687d67afc691f0cfba15fc5f4ac78d190a4c
  • MD5 226747848bcc19281397f948c7d13d0e
  • SHA1 a8701f870b4a9b92fe40228023ebd802e0d80a52
  • SHA512 7252e7a5a748a5f65a4ad47d8db05bc7ca41d4b8998a3c3ca96e643b1f9d4e520f18ee078d1c1094df852789573e719818713d28c88076dd7c9c5db723ff76d6
  • SSDEEP 98304:Fnsmtk2a1mtk2aimtk2ajkHhDPiLjhn7n9:ZLtEYkHdU9j9
  • TLSH
    T18BE59F22F2D18437D2321B3C9C5BE3A4582ABE552D34B94E7BF83D5C5E3D68228252D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorguest16discoverydarkcometneshtaxredpersistenceratspywarestealertrojan

  • Detect Neshta payload

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2