Extracted

• • Target
    2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_ransomhub_rhadamanthys_smoke-loader
  • Size 3.1MB
  • SHA256 ea47671c0fd907384b6f9507f46815b9ebe5558d28f948ea9b49704a4340db35
  • MD5 053a844cedc7ac30419f34bc24e225d7
  • SHA1 26eb96b782bb9032d5b0604f50135abf2feb932c
  • SHA512 76ac06954fb2aecd0d2a70af7c5da9176c98c3e03b41f1adfe6c1351020245d1210cdb5464229b8778f85d36e452d565ae072acf5277cab64cfe91c1e98a7c4d
  • SSDEEP 98304:0nsmtk2acmtk2aEmtk2at4x8xqCGomypGFnmn9:aLiSVgtvYZY9
  • TLSH
    T182E5AE32F6D18437D1721A3C8C5BA3A5582ABE512E38794B7BF81E4D9E3D78138252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2