neshta | 52c710962c92e333e7d18981d8e85186ed36d25656def164e5f2cf6b34fad042

General

Target
2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glassworm_neshta_rhadamanthys_smoke-loader_stop
Size 4.3MB
Sample260528-e49z8aft4k
SHA256 52c710962c92e333e7d18981d8e85186ed36d25656def164e5f2cf6b34fad042
MD5 7e68ca52540e0880a71c51c0e2499aa6
SHA1 995695f173d89efcd6f4a1be62060c3047da691d
SHA512 cb9f0d34df3344211a8dd401465d80e107aff6fe8af8086b6737b226360b03874fe755977af0096f9b32b0210646e508b44ad263c66976974e8ec9cfe1a15d24
SSDEEP 49152:insHyjtk2MYC5GDNHyjtk2MYC5GDZOY/SiSf6KSIshmgTlxRQv9rn0KtX2pyJz0c:insmtk2a4mtk2a6KZshhYv9ptXZJeon9
TLSH
T14D267D93B2D65836C06236B94C3F9754543EBF102A26594A2AF43D4CEF39183EC25DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glassworm_neshta_rhadamanthys_smoke-loader_stop
- Size 4.3MB
- SHA256 52c710962c92e333e7d18981d8e85186ed36d25656def164e5f2cf6b34fad042
- MD5 7e68ca52540e0880a71c51c0e2499aa6
- SHA1 995695f173d89efcd6f4a1be62060c3047da691d
- SHA512 cb9f0d34df3344211a8dd401465d80e107aff6fe8af8086b6737b226360b03874fe755977af0096f9b32b0210646e508b44ad263c66976974e8ec9cfe1a15d24
- SSDEEP 49152:insHyjtk2MYC5GDNHyjtk2MYC5GDZOY/SiSf6KSIshmgTlxRQv9rn0KtX2pyJz0c:insmtk2a4mtk2a6KZshhYv9ptXZJeon9
- TLSH
  T14D267D93B2D65836C06236B94C3F9754543EBF102A26594A2AF43D4CEF39183EC25DAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery neshta xred persistence spyware stealer
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Custom signature
  
  UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2