Extracted

• • Target
    2026-08-19_6b1bfb7676034f301765a6bd1344769c_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_njrat_ransomhub_vidar
  • Size 2.6MB
  • SHA256 4afc6d951eec42233e3ca6746f215eff7c7946b1c285ed48d6635c6080681e5e
  • MD5 6b1bfb7676034f301765a6bd1344769c
  • SHA1 4821c720a1d63850cc48ee92a7ee1605292123c3
  • SHA512 6835422eafbd8751eb5a78c7b040fc535a9379d650aee3f8f441b946b39b1875692ca729fe8c95e849e824cc63b854d90e391c64a67e2537bcf92f6d7d8402e4
  • SSDEEP 49152:DHyjtk2MYC5GDAHyjtk2MYC5GD1Hyjtk2MYC5GDEABenknkn/n9:Dmtk2ahmtk2a4mtk2a8enknkn/n9
  • TLSH
    T1E6D58E22F2D19477D1321A3C8C5B93A4983ABE512E38795B7BF41E4D9F3D6812C292D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2