Extracted

• • Target
    2026-08-02_51f0b5997d1ee6cc783f603ee0839a2c_amadey_cobalt-strike_coinminer_dark-comet_darkcomet_darkgate_elex_gcleaner_hijackloader_ransomhub_smoke-loader_vidar_wannacry
  • Size 6.8MB
  • SHA256 00a748646d50aa0463e64b2ae2b5d0e00e43b71ef44038b3647ee8ff4a221092
  • MD5 51f0b5997d1ee6cc783f603ee0839a2c
  • SHA1 e75e705d1a7a453c53f218528a8ce1940b20660a
  • SHA512 a4c9361aaabc4773a755a02a5e68e0bbc6b1650f47abd112bdc78eee55acf93d0d80ef852d41f22dddb4f0d4c96f1c01b189aa7de9b2616e5d4796535727e03a
  • SSDEEP 98304:olerjesRJ8YQU/tK+JLzPOEHvm22SPOA1rr5:frj578YQr+JPXP/1n5
  • TLSH
    T11F662B11E2D20122EC666530CCAE565856337D602F3D83EB254BFEBD2F326B0D9B5366
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2discoverydarkcometneshtapersistenceratspywaretrojanstealer

  • Detect Neshta payload

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2