Extracted

• • Target
    2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar
  • Size 4.9MB
  • SHA256 281c45dc061cd24b1628e55253ca4b31058ba3a85735780ad32dd185d4476e85
  • MD5 231ac40a91e72c6bfef8f086e4d547db
  • SHA1 bf5764fd0fd9eb4cacb6af86b0f58c6b4a8d0580
  • SHA512 a51163bf633755180415c675e911b56cba1d13d8cb37e4f8c1ff877596de0b42082bab56838eceb4d460963ec77de2e94692f2c6072ac099f25e1ec4aa641682
  • SSDEEP 49152:knsHyjtk2MYC5GDXHyjtk2MYC5GDZmgJF4SKXiXYTSwfxuxG/s65tXKHRwa5X/bl:knsmtk2aOmtk2a3Zftfuq9LsSku0n9
  • TLSH
    T1E1364C13F29150FAC03AD578875B6232FA317C490B347AEB67D45A352E26BD06E3D34A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2