Extracted

• • Target
    2026-11-03_b2d2d2202ddc8561bd3ef6ec807c1858_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_neshta_ransomhub_rhadamanthys_stop
  • Size 920KB
  • SHA256 66234d2e1b31310251c0704efe1b14905be7910bddaa75edcca0e621f4a171d3
  • MD5 b2d2d2202ddc8561bd3ef6ec807c1858
  • SHA1 57a083bd99bb7d6ff28ab50a71b77b6ab5f5fcc4
  • SHA512 e539b9b2744c05be9a5ff52c6e8afb3deb93225ec145216e40e207eef5dd95322f965c56a2d066d688b7092eb5d2b3ad046c1a1c22e2c2a2d500d17889ba6be5
  • SSDEEP 12288:LpJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nar8Hab1RWMQMS9:dJ39LyjbJkQFMhmC+6GD9vanAn9
  • TLSH
    T18E158E22B6D18437D1722A3C8C6BD3A4583EBE612D38795F3BF81E4D5F397812925293
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryneshtaxredpersistencespywarestealer

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2