Extracted

• • Target
    2026-11-02_bb0544fb1c2c3cf18f597a8f8390ded2_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_ransomhub_remcos_smoke-loader
  • Size 2.9MB
  • SHA256 de29fb2cfe1a0a180a70c7cf644986e16037247bad677bdff63870dd1403e7f7
  • MD5 bb0544fb1c2c3cf18f597a8f8390ded2
  • SHA1 9240614b00dcfe1e1e77050e392bcb1aa18f2d78
  • SHA512 b8e2bbcbfe52d0834dacab676c2769957e1fc9c4023a543c855983eb8fafdbc4a2c2f27dc82c34043c8046bc7bf485641f1c102f9398864baafd3e91f5f19fcc
  • SSDEEP 49152:lHyjtk2MYC5GDMHyjtk2MYC5GDsHyjtk2MYC5GDTlIyoKIXIvsRnXnun9:lmtk2atmtk2aFmtk2aKeFD0CnXnun9
  • TLSH
    T1BBE58E22F2D29033D1721A7C4C6BA3A9582ABE512F347ACB77E41E4C5E792C12D352D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2