Extracted

• • Target
    2026-11-01_c44f93acd96c5fbb5ca4f6dd41b176df_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_ransomhub_rhadamanthys_stop
  • Size 2.4MB
  • SHA256 5c9614537e5adb5cbf8efc0144e42cf4509d94642476510ad8828520628e1049
  • MD5 c44f93acd96c5fbb5ca4f6dd41b176df
  • SHA1 274db1fd979a956e6d1e52d55724b8c6bd3c8c5b
  • SHA512 f82f0525c6c5d21c6ee74865caa578e76d40bb2c770731fc123815266a937a20680b5921a12cc1f1c8cd876bed44c4860f4dc9f3a082926b167e048406162555
  • SSDEEP 49152:dHyjtk2MYC5GDlHyjtk2MYC5GDhHyjtk2MYC5GDZanAnqnWn9:dmtk2asmtk2aImtk2aoanAnqnWn9
  • TLSH
    T11AC57D22F6D18837D1722A3C8C5B93A4582EBE612E38795A3BF81E4D5F3D78139152D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2