General
-
Target
2025-05-22_22e5c0e1c415bcf11a16a7763428bb03_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer_smoke-loader
-
Size
5.2MB
-
Sample
250522-lpxvnscr8s
-
MD5
22e5c0e1c415bcf11a16a7763428bb03
-
SHA1
76f91069de8b599459873ca425e165d7168a2f7e
-
SHA256
016490d65b7accf1947fe1a9b3c0249fb107cb1369feb9698da8916822821d1c
-
SHA512
3d8a42fff1d4f77320aae93eda1a3f8de0b58afaaa931dea4c4785190dad7fcd71bf06393ab343668b806556fc4a9a8a8569090bfdbbbfb415286acb07f5aa60
-
SSDEEP
98304:Cps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:kfefPJws3V+a
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-22_22e5c0e1c415bcf11a16a7763428bb03_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer_smoke-loader.exe
Resource
win10v2004-20250502-en
Malware Config
Extracted
latentbot
myhostwin64.zapto.org
Targets
-
-
Target
2025-05-22_22e5c0e1c415bcf11a16a7763428bb03_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer_smoke-loader
-
Size
5.2MB
-
MD5
22e5c0e1c415bcf11a16a7763428bb03
-
SHA1
76f91069de8b599459873ca425e165d7168a2f7e
-
SHA256
016490d65b7accf1947fe1a9b3c0249fb107cb1369feb9698da8916822821d1c
-
SHA512
3d8a42fff1d4f77320aae93eda1a3f8de0b58afaaa931dea4c4785190dad7fcd71bf06393ab343668b806556fc4a9a8a8569090bfdbbbfb415286acb07f5aa60
-
SSDEEP
98304:Cps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:kfefPJws3V+a
-
Latentbot family
-
Sets service image path in registry
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1