Extracted

• • Target
    2026-11-05_b178ae43d32330b88155bafaff2fa003_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_ransomhub_smoke-loader
  • Size 9.0MB
  • SHA256 55b2dcf7774e3948ae0d4a37ef6c2a00cda099a8510dd8075d5a8c645df13c23
  • MD5 b178ae43d32330b88155bafaff2fa003
  • SHA1 9cb33c5a1fd02ca5f9c62cef57cf795639b6e45c
  • SHA512 3cab66c920f7f7b5aa627bf03b1ab7e6d5558f2cce9402bd1b7d82d2bd9611bae93fba7290466b0ab4f0f5840fbb1c9d8f35e70a0d28e5133637637a076a911a
  • SSDEEP 196608:tLxeztnQGlgZLZKjSMdXPe2sia6uQgeUhdluV6S9:at44OCPjsi9MRhdlM9
  • TLSH
    T1A9962362F2928033D162163DDC176364983DBB601F6931DB77E83E8D6E392D17A38297
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryneshtaxredpersistencespywarestealerupx

  • Detect Neshta payload

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Modifies firewall policy service

    defense_evasion
  • Custom signature

    UPX dump on OEP (original entry point)

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2