Extracted

• • Target
    2026-05-28_a7479db9086937b2996910d97bcbfbfb_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhadamanthys_smoke-loader_stop
  • Size 2.5MB
  • SHA256 9f309ec6955fc7f4fc7facd01060b6c5a7307b779a07ac1d7246540c609efcbc
  • MD5 a7479db9086937b2996910d97bcbfbfb
  • SHA1 4ec3cd3f5fe16d3b66458178bf670b33aae7c3f4
  • SHA512 ddda6c8299005c7dd7ba65ea47f08bb24c6015c44fa4d58a78b79cd3ce0bc613c675224f09c823698298479678e0deb2beab2c0d6b4cd904bf8ff58c8685c5ff
  • SSDEEP 49152:OnsHyjtk2MYC5GDuHyjtk2MYC5GDeHyjtk2MYC5GDbP1Xntn9:Onsmtk2azmtk2azmtk2aYXntn9
  • TLSH
    T131C57E32F2D18437D1321A3D8C5BA3A5983ABE512E38794A7BF91E4C5F3D68139252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2