Extracted

• • Target
    2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_njrat_ransomhub_stealc
  • Size 4.3MB
  • SHA256 08f30bb471c53a33ac9ac940d2af9eda22896190342b6402772778c41fb5c6bb
  • MD5 d98a98f4b254dca80c18d84c3041879e
  • SHA1 02056591a0be17c69ca79b4ac3aca022388ccba7
  • SHA512 a66cb74a3adf43d240bacc9d88f99946b0ef387c207098296da726e1dbe3b07007672a169d94abd8ea9285d6fd83c2b3d6236a25cd43af514c57d59551148e8b
  • SSDEEP 98304:+nsmtk2alcmtk2aFcmtk2aocmtk2abcmtk2ag3nsnIn9nq:ALG7O7n707P3CWhq
  • TLSH
    T117267E22F2D18477D1721A3C8C5B93A5983ABE512E38794B7BF42E4C5F3E6812D252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2