Extracted

• • Target
    2026-08-11_b8ee8300e931edfbde1b6f9f51f681c0_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_njrat_ransomhub_vidar
  • Size 3.4MB
  • SHA256 914131ca51a33b279c243461dcf31223c12e43cf200e732d12ed7c75c07f9f49
  • MD5 b8ee8300e931edfbde1b6f9f51f681c0
  • SHA1 e06bcdf556d39b3e4a0e3629c018fdeae6246d9c
  • SHA512 391ef052ea0e3baf9ab4d25e23c67a0f242ba32fd50a845614f3753b2856fd959da5632719e5c69260723c59d3d34d384db380c8aa7f46acde54d57c71138853
  • SSDEEP 98304:onsmtk2a5mtk2ahmtk2a4mtk2a8enknkn/n9:2Ld9ChgKKP9
  • TLSH
    T1CEF57E22F2D19477D1321A3C8C5B93A5983ABE512E38794B7BF81E4D9F3D6812C252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2