Extracted

• • Target
    2026-05-28_87ed0be1fc169354f8595d27b825deab_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_rhadamanthys_stop
  • Size 2.3MB
  • SHA256 fe688a201f98a2aa709a4da98ab9710ff31c6ad9c157a0e4385930a9d91559ad
  • MD5 87ed0be1fc169354f8595d27b825deab
  • SHA1 43c90125800646e9e9038598608aeb91076a7485
  • SHA512 4f91f5f64648d41050483325577899c181b3b33fed4c021c36d28351cf4acf945dd673c5205416d0aacea960f79f610ee356abe10f957dbcf16bcc6816b3cf3d
  • SSDEEP 49152:unsHyjtk2MYC5GD1e2Hyjtk2MYC5GDADZ/2sP+ntjaN0ZxtVg8In9:unsmtk2aoe2mtk2atF/zGtjZOn9
  • TLSH
    T18BB59E22B2D18037D07316798D6BA3A5583EBE212E34694B7BF82D4C4F396C27D25397
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverybabylonratneshtapersistencespywarestealertrojan

  • Babylon RAT payload

  • Detect Neshta payload

  • Family: Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2