Extracted

• • Target
    2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader_luca-stealer_neshta_njrat_ransomhub_smoke-loader
  • Size 1.0MB
  • SHA256 7055d4a8119376b44d406afefbf3c98312d6f380e82cbcc54c5d94177c3011ff
  • MD5 a11b778d0b490b84c8415bfde93e2445
  • SHA1 99aa0002368bc2e45cee289b549d69fbeb562aec
  • SHA512 fd0fd1b893eb3022dd668f16b858a0e9e430c626e0855a5507d571119b96aa0f4628767d7c51a1321032028dcba8d785daeca0c3ff5d7088897c4358ad58541b
  • SSDEEP 12288:lpJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9H5L5PRYaE8jYo1EF3MS9:rJ39LyjbJkQFMhmC+6GD995JYaZcAwn9
  • TLSH
    T15F358E22F6D18433D1721A3C8CAB93A5983ABE512E34795F7BE81E4C4F3D6C129252D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2