Extracted

• • Target
    2026-08-19_ec7045f7acd9654ac986f621f7a49c5b_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_njrat_ransomhub_vidar
  • Size 4.1MB
  • SHA256 35e41d73744493af80bf6fe62c501e2ee45ac79a8b5dfa440bb271202901a570
  • MD5 ec7045f7acd9654ac986f621f7a49c5b
  • SHA1 06fe60523cb225b651c05604d56a56a798c897f2
  • SHA512 40180be7cf84987471a30159e1656c1b7d77ec16c7a98e8902b1326fe1ac88ac7e85d16911fa7fe40975d3f135c4ee1637351d6ad3d3d79c2a6c1d177f7ba385
  • SSDEEP 98304:Unsmtk2a4mtk2a5mtk2ahmtk2a4mtk2a8enknkn/n2n9:6Lmd9ChgKKPo9
  • TLSH
    T19D167E22F2D19437D1321A3D8C5BA3A5983ABE512E38794B7BF81E4D5F3D6812C252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2