Extracted

• • Target
    2026-10-13_31e3ab36c7c3266a7bd46ca79d682b55_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_njrat_ransomhub_stealc
  • Size 5.0MB
  • SHA256 542a63eabb1d74b6e8ee6c6ce17dd1696e332df72cc9fcaa3a3515551a25e357
  • MD5 31e3ab36c7c3266a7bd46ca79d682b55
  • SHA1 0e2fc36c0e0f414c784c386327692a202e0852c3
  • SHA512 634b14ce9c5442adce9d80e7cd7d3c26b1c6b0c4fd59a7cce40afca9cf40dabb182febdc0bf7b5d3baf34d78a939f68012ff43c9f3c18e71082fd91d644faead
  • SSDEEP 98304:6nsmtk2a9cmtk2alcmtk2aFcmtk2aocmtk2abcmtk2ag3nsnIn9npnq:0Lm7G7O7n707P3CWh1q
  • TLSH
    T1C5367E22F2D18477D1321A3D8C5B93A5983ABE512E38794B7BF42E4C5F3E6812D252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2