Extracted

• • Target
    2026-10-28_bfb35321e23ea5f9919d2e5aeb1e7ae3_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar
  • Size 3.5MB
  • SHA256 e8d8b76c9535d1cd69d48e8888584918ae180304110b0199bdf397c8967ac264
  • MD5 bfb35321e23ea5f9919d2e5aeb1e7ae3
  • SHA1 b0c4583ce50dfdbb41ef18596f4377fc5d2b7c4e
  • SHA512 b71fc53c99a6a2d3914f77047105ecb3aa6d0f4415158b952ef1f2839df1081dec7e4a54de5346d1c61643157e8dc22dca7402d662cb0c2fe8c5944f06748f16
  • SSDEEP 49152:+Hyjtk2MYC5GDPHyjtk2MYC5GD0Ns4iuAJVmhQpffMW2kZaSCOkhjnqn9:+mtk2aWmtk2alKnu2VF8kZVCtnqn9
  • TLSH
    T109F58CA372E5007AD07E92384816827DCAF77D1D1BF259CB56E23D481F3AA8D2E35352
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2