Extracted

• • Target
    2026-08-10_71253810058a8157705026928c03072b_amadey_elex_neshta_ransomhub_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 191KB
  • SHA256 a314c6e423d47a5005b065cddc8eb28b45b45271108ab7b12f6f3bcebe788307
  • MD5 71253810058a8157705026928c03072b
  • SHA1 adebc45b2138ebb4554cc1fe6b2d0e83ae5d5445
  • SHA512 766ac61b58b526570e052829afcc232488454ffbf3a57f6a9a18cd0ef04b150895fbb3ff11d2f6933fa4bfcd27e5ab4da62a98caaeea9989ac2bc8062fc8581a
  • SSDEEP 3072:sr85CDDlZNWXpYQVts2Z6fvk9HyhAf5ChAf5:k9nAXemtT6X8Yz
  • TLSH
    T12A14D006F891C433C02159F9493DC1545B3FBA211B6946DB7BA81AAE9F363C1EE3921E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdiscoverymylobotneshtapersistencespywarestealer

  • Detect Neshta payload

  • Family: Mylobot

    Botnet which first appeared in 2017 written in C++.

    botnetmylobot

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Detects binaries and memory artifacts referencing sandbox product IDs

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2