Extracted

• • Target
    2026-08-07_2b3b0cf76266ae31b0dffb1ede0f37ac_akira_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_ransomhub
  • Size 3.4MB
  • SHA256 922e9d7b4931f45f3f2722713dabf1a24a8a0e2dbe9bceb80d0902da52dd48af
  • MD5 2b3b0cf76266ae31b0dffb1ede0f37ac
  • SHA1 e4006e1ef2a999346ac4c0312a37af872d922806
  • SHA512 5ac05c35186f8633194dbab99ddb4cbd3300029af29d58d1e3c6decd82a4a5399d581bdfd263213a76ac313edf01730a0479158352c4a9c249e58a4054584a99
  • SSDEEP 98304:kmtk2aqmtk2axmtk2aNmtk2aS8nDnynCn9:jUlpqb8M9
  • TLSH
    T15BF57D22F2D18477D1321A3D9C5B93A5983ABE512E38794B3BE81E4C9F3D6813D252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2