Extracted

• • Target
    2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_ransomhub_rhadamanthys_stop
  • Size 1.5MB
  • SHA256 160e664017d807cf822652990778789272305630f0249dd649ef978e482c903c
  • MD5 672a6527baa90b0b2037ca9f6bc186a9
  • SHA1 ad609b710a80804d7b87ac252e378ad92893a685
  • SHA512 71819149bdc78068a08a1ef6571bcbe8d4502c61427d53a2beadfc1d13e75175253ca5d65c3ff8611ca6781aacdb757286872caa3a2d7ef9647e886c829b3b4c
  • SSDEEP 49152:T2Hyjtk2MYC5GDADZ/2sP+ntjaN0ZxtVg8In9:T2mtk2atF/zGtjZOn9
  • TLSH
    T14575BF23B2D18037C07316798D6AA365593EBE311E34694B7BE82D4C4F396C1BE29397
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverybabylonratneshtaxredpersistencespywarestealertrojan

  • Babylon RAT payload

  • Detect Neshta payload

  • Family: Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2