Extracted

• • Target
    2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhadamanthys_stealc_stop_tofsee
  • Size 3.3MB
  • SHA256 6f52f69c303432dec22989cc6201036ede691bdf2764211da2f052283d072e2e
  • MD5 b1994d75b730e7d2460e18daae3b2759
  • SHA1 7f8067cdd02ada549645ff0b8e48979206702835
  • SHA512 daf97c98168f0affbc5fa3014291367dda22428b7c120445145f6f322ef91164f6970e1af9f050bd485ae2fd6fc48aae2113b57fba2f6141b7ca6e491494fe2e
  • SSDEEP 98304:Bnsmtk2a7vnmtk2abvnmtk2aUvcAlMHi1Up9ygmnPn9:dLffQtHi1UzygYf9
  • TLSH
    T14EF5AF32F2D19437D1321B3D8C5B93A5982ABE512E38794B3BF82E4D5F392812D252D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2