Extracted

• • Target
    2026-07-15_c63dc014c31dcab3b7f5df864be6092c_amadey_cobalt-strike_coinminer_darkcomet_elex_hijackloader_vidar_wannacry
  • Size 5.5MB
  • SHA256 8115145b36fc4b994e0998fd2d5c5d8c7e447a046a4c24295a997d2f3af89f28
  • MD5 c63dc014c31dcab3b7f5df864be6092c
  • SHA1 e13c88215ee1fafa22fccdeae05ab5da8675b48b
  • SHA512 f3a5f48515981b2c599ff7730c6476f72cf55c8f2e94ac1a693611e9365152871f332ec47a09976d891b93f900ce454dc1c137278a78a9c8b2eb759ea3b4a83a
  • SSDEEP 49152:ol/ijN5j2Xsl3RJ3LHobUQDgok30sH91qkqsUH982HGqCdipL8OyCPONqJtb2Iw:olerjesRJ8YQU/V1qft8F1diJLPONJ
  • TLSH
    T145464B01E2510123D8656070C99E774866323F702F6AD3E76A86FA7DBF327D1C8B6276
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2discoverydarkcometneshtapersistenceratspywarestealertrojan

  • Detect Neshta payload

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Custom signature

    Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2