Extracted

• • Target
    2026-11-03_3bc556c8b82d0fddc1f20976db75d6d3_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_ransomhub_wannacry
  • Size 868KB
  • SHA256 8ca5bbb021ba1bdf16a4282ba2395dd6a6a818d22983fc39f69ca4d43e52d8d8
  • MD5 3bc556c8b82d0fddc1f20976db75d6d3
  • SHA1 483ec69e2bd0d743bdb23e03ab146ec07d1b4da0
  • SHA512 eae3d11f6d1bbf592ffd8392c9556bddec3266005903b260965d984f29e0e5f98d6bba44e6e56b6b8f4d2949dc0f8106bc94886ca34b0f5d6623240ad3930d61
  • SSDEEP 12288:LpJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9TzZny5lG4qNfHV3MS9:dJ39LyjbJkQFMhmC+6GD9HZny5lG4Mn9
  • TLSH
    T152158E22F6D18837D1322A3C9C5B93B4583EBE612E38795B7BE81E4D5E3938139152D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2