Extracted

• • Target
    2026-08-10_5f8bc94b16004105131a4bcc15251e6f_amadey_elex_neshta_ransomhub_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 191KB
  • SHA256 3e1db0cdc8624821c3abadeac25c46353ba52956d5faab8519481d016e750863
  • MD5 5f8bc94b16004105131a4bcc15251e6f
  • SHA1 a57557a33b10769fbe072dd41adffb86dd082078
  • SHA512 d71773013c7f35f3f6128aa3208dc896d0ef61f4ba3c64e7ded688fd2a52613590f952cbe500653c552a1856a85d3709f77808d851d31b9ca86b4ac789125eb8
  • SSDEEP 3072:mNf5SDlZNWXpYQVts2Z6fvk9HyhAf5ar85C:zAXemtT6X8Y59
  • TLSH
    T1D214D006F891C433C02159F9493DC1645B3F7A211B6946DB7BAC1AAE9F363C1EE3921E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdiscoverymylobotneshtapersistencespyware

  • Detect Neshta payload

  • Family: Mylobot

    Botnet which first appeared in 2017 written in C++.

    botnetmylobot

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Detects binaries and memory artifacts referencing sandbox product IDs

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2