Extracted

• • Target
    2026-11-02_ec5a501688986e8156ca677314126125_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_ransomhub_wannacry
  • Size 2.4MB
  • SHA256 e2b798cee00e69b779febea350456c8fcc2546c7a13000bf86132c9a52a3dea5
  • MD5 ec5a501688986e8156ca677314126125
  • SHA1 fadd57fe9ec9f9029cfe29ba15d9950787ffb3b2
  • SHA512 0f871542e8601bfd8b91f11638cf3e56ccd59c6fc64749e0a500f997badfe55071fef1e8876833fb90b824217084787a2cc85ee22a61d751b4ffc2761664e6e2
  • SSDEEP 49152:dHyjtk2MYC5GDHHyjtk2MYC5GDKHyjtk2MYC5GD0lG4MnPnan9:dmtk2aOmtk2azmtk2aBlG4MnPnan9
  • TLSH
    T180C57E22F6D18837D1322A3C8C5BA3A4583EBE612E38795A7BF41E4D5E3D78139152D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2