Extracted

• • Target
    2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader
  • Size 5.4MB
  • SHA256 d25913ba040d70de14254085df9b61f8b4f940568d2b1815b473b52feb456abb
  • MD5 4da4a76e7f7157e0066b5396c83ac280
  • SHA1 ed449b1c55f2c5f6abaf8534f8b2315520f1b052
  • SHA512 b924a7f761354ad9b927b5f190a5ab9d40056360e07923e75c12cc6a8d4f3da43ded29942e77d2fd65506cb3d9664cd8b8f51dcc0c1467c60956ceb0977b6ee7
  • SSDEEP 49152:Fl/ijN5j2Xsl3RJ3LHobUQDgok36O4Gc1qkqGOyCPO04tqC0DKA0D2itrqEipYq:FlerjesRJ8YQU/6V1qfVPO0610QZ86
  • TLSH
    T192464B01A3A24123D8616574C89F774856307F742F3AD3EB6E06BA69BE327D1C836379
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydarkcometneshtapersistenceratspywaretrojanstealer

  • Detect Neshta payload

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Detects executables packed with ASPack

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2