Extracted

• • Target
    2026-08-07_e8d3725c0eed526afe54298259b13bae_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_ransomhub_rhadamanthys_smoke-loader_stealc
  • Size 1.2MB
  • SHA256 83589fb3f66caaba2ef45bdd5ebf1a6e5c215ff536b326037713d9d3d3463360
  • MD5 e8d3725c0eed526afe54298259b13bae
  • SHA1 0f69de46e65eb574e88c2452a28d23552be39669
  • SHA512 726ee8d6cdfcb5b5a3b6de42927d58e9d51ebb4f420eb37e1fb78fd4c172516feed2e312ddb8f01c2c7b23fdb93162d058b36a88696befd7deb07f08615a81d8
  • SSDEEP 12288:0pJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V98QX7ghRC+YzF8KsL7nhEX0MA:wJ39LyjbJkQFMhmC+6GD9++LFEzn9
  • TLSH
    T129459E32F6D18437D1721A3C8C6BB368842ABFD12D34694B7BE97D4DBE3D6812815293
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2