Extracted

• • Target
    2026-08-06_265cd8a0b86a2f052dedf4d418b0db15_amadey_cloudeye_darkcomet_elex_ransomhub_smoke-loader_stealc_stop_wannacry
  • Size 8.0MB
  • SHA256 7a389a969cc48d42cfae50e5456133b86c256f728958cc69dd9c34e1ceca835f
  • MD5 265cd8a0b86a2f052dedf4d418b0db15
  • SHA1 183d2a327cd7f7100b93ef05a11b18a6a05889fd
  • SHA512 345b0683722e0efc4e45c62ce4b1b7dec59713b334bdffd9593f8e4e30d1a52e8292beb8cfbc51c6cb6fb64cb0ad4aceaf97df7213dec24b928d7798f570ca75
  • SSDEEP 98304:olerjesRJ8YQU/A5qe1qfUK+JLBmMrm1RF4Yv5nPOpHmMrm1RF4IF6:frj578YQKe1qf7+vyHFRFPoyHFTF6
  • TLSH
    T1F2864B12F2E04122F4B26570CCBD57659A337D506B38C2FF5286BAAD1E72BD2D831366
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2discoverydarkcometneshtapersistenceratspywarestealertrojan

  • Detect Neshta payload

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2