Extracted

Extracted

• • Target
    2026-09-04_9bfeddf2bd3d4433853570d4192757c1_dark-comet_darkgate_drokbk_elex_gcleaner_glassworm_neshta_ransomhub_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 8.2MB
  • SHA256 b13fb97a0ce2ef9ff7632e913d247df61b9a36c656deae27b6f38e1d0c82e2f0
  • MD5 9bfeddf2bd3d4433853570d4192757c1
  • SHA1 1d47bfff8872ea0d1669be2611ff83498e4a394a
  • SHA512 8846e888f9addcb7595d302c20f4e0042961c8d2046b4be3eb155c1ba0c8ca7dc209f30602445af2ca0a8bce3484df5edb479b5d781a544e699c67e88ce07175
  • SSDEEP 196608:AMPL4RcyBG9lSG8NonzqKR1Gt8Fop7VSxom3njXa0brx9:/Pb8mlmtK1Gt8FolAnza0brx9
  • TLSH
    T1E5860233B690807BC0724A799C5B93F5A8397F511E34694B37E43F8C6E79282786538B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverymofksysneshtasalityxredpersistencespywarestealertrojanupxwormmacro

  • Detect Neshta payload

  • Detects Mofksys worm

  • Family: Mofksys

    Mofksys is a worm written in VisualBasic.

    wormmofksys

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2