Extracted

• • Target
    2026-08-07_12ce51904d2544c5c48056d1976fa2d9_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_njrat_ransomhub_vidar
  • Size 3.4MB
  • SHA256 17f5687663c5ca02f62d3949f53299f25e963d211857aafb6c89078b3f45f3cd
  • MD5 12ce51904d2544c5c48056d1976fa2d9
  • SHA1 2f8766535e709ab9b63ecbcaeea56d1f38de0ae0
  • SHA512 a36672f447ab5c752d127a10084ce418f8c7c743fb358af1bf66802184bfc9dc2f6a3c7a96f61e0f6137a1720cfd1f6e4df8b3167aa163f80c5b3d9f8645ac3e
  • SSDEEP 98304:Dmtk2a5mtk2ahmtk2a4mtk2a8enknkn/n2n9:ed9ChgKKPo9
  • TLSH
    T12EF57E22F2D19477D1321A3C8C5B93A5983ABE512E38794B7BF81E4D9F3D6812C252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2