Extracted

• • Target
    2026-05-28_dae605002fe1b75c5b3f12dd791faca2_akira_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_neshta
  • Size 5.4MB
  • SHA256 052e9a6a4990b721e4d4b5194a2e8171b1ddf09ed3c53fa1e0408a3145437b52
  • MD5 dae605002fe1b75c5b3f12dd791faca2
  • SHA1 2371b737df4ce13df7987f89ea55a992724a902e
  • SHA512 48060dc0172528b362193ed57de95d1d18d41c57e483c97f9f43b32898c9dc2c535fe85867ced2f0daa6e9aff3a92c339762bbdd09c230879985b333c5ef5b85
  • SSDEEP 98304:9nsmtk2a3mtk2azmtk2ao396Cfp4Xg2t+FC7n/n9:hLbfT96Cfp0JkCjP9
  • TLSH
    T10346C002FAC38577C1571A385C1FA33A8A36BD011F28EB97FBE41D189D3A3912D65297
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2