Extracted

• • Target
    2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_ransomhub_rhadamanthys_stop
  • Size 1.5MB
  • SHA256 d2e9e026df4d19fa058584ed39ad7b22359a9176e32957fe4c24e55bfa9da9ad
  • MD5 3b5ef6680becec7677869c6c5bbb4578
  • SHA1 9ca96829f4f870f7a5621a02b1e6e05f10a0a9e7
  • SHA512 a83ef1203d4c772a3937188453a6a8e01c921d83e5fffd5925c033b86b937bbef7f39872c5945db388b1ab7e17969b43b64c3e754f7dbf07024b50cce1db6d76
  • SSDEEP 24576:SnsJ39LyjbJkQFMhmC+6GD9G1yeZ/2sP+ntjlANrWa4ZxtVgfibwQ:SnsHyjtk2MYC5GDADZ/2sP+ntjaN0Zxd
  • TLSH
    T15675BF23B2D18037C07316798D6AA365593EFE211E34694B7BE82D4C4F396C1BE29397
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverybabylonratneshtaxredpersistencespywarestealertrojan

  • Babylon RAT payload

  • Detect Neshta payload

  • Family: Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2