Extracted

• • Target
    2026-08-17_bbadf9444a2c63a3bffd385dee7d960c_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_njrat_ransomhub_vidar
  • Size 3.6MB
  • SHA256 9ed69114a3548a70822718ff97285d70ba1734b513556fbc2ff9d6a14f65c9a9
  • MD5 bbadf9444a2c63a3bffd385dee7d960c
  • SHA1 545d300e1ff8543b21a0ce56520316622289475e
  • SHA512 c023e4ffe8ea7b79afe08c051e9db57f08d9e0f6174d88470bffab8eb77a1d5962a1d37b979e1fc711f018def5d56d9a92eee893de4ab8c70bd206edb6ccb382
  • SSDEEP 49152:YHyjtk2MYC5GDr8sl3WivlbK7vnLX7z30pxzBny060vnmnM4atqZdd1v+0Krbun9:Ymtk2ax3idzBy0bnmnM4aqTPKrbun9
  • TLSH
    T17206AF50B2F784FAD23281389816D725C571BB412633922F31696E4CDF7B7832D2DB6A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2