Extracted

• • Target
    2026-08-07_4e37b8b0cfe97165fd5f231103f1581b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_ransomhub_rhadamanthys_smoke-loader
  • Size 2.4MB
  • SHA256 e7199c61c48eb89dae35885e76c5bb87a9ffa2a99bdfae70bc95f80c53dc503c
  • MD5 4e37b8b0cfe97165fd5f231103f1581b
  • SHA1 2db8e813f67fac51dbd14ca20237733a658e5173
  • SHA512 03669885e53ed6678b94ec04371425fe1acd5258c947a030cb77716317cefda6345e2fd5949242eef4c041c985c50cf85ed90af4698c82b48bbba889b74007cd
  • SSDEEP 49152:RHyjtk2MYC5GDFHyjtk2MYC5GDy4x8xqCGexm8FCspg0iZf1LUXgnmn9:Rmtk2aEmtk2at4x8xqCGomypGFnmn9
  • TLSH
    T1F5C5BF32F6D18437D1721A3C8D5FA3A5583ABE512F38698B7BF41E4D9E3938128252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2