shodi | 5a9b93058484ea6e27e1ddbeca7ae31521af802a0b8f5f5674699dce6935d2c7

General

Target
2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader
Size 3.8MB
Sample260418-k33gmscs7l
SHA256 5a9b93058484ea6e27e1ddbeca7ae31521af802a0b8f5f5674699dce6935d2c7
MD5 df11cf4151756c42e7f0e8f72c7886e1
SHA1 28d3687920d64148723551b33588c4c1ebbbd56c
SHA512 ac3a3d70adcdc60d87606fe623d415e47e9770cbb2573b8143c0a4506c271fe3931bdd6a16886d9fffb74e2eea40e62050c15df5ae95da5a48cb7dbeda8bac58
SSDEEP 98304:Q6PKbXsPN5kiXx9vuFOnYHEuK59sePl9oGoNoswfX:QKl5XjvUCPQLNmfX
TLSH
T1AE16C0227BD58035E4B281B16A7D9A77D57DBC340B7559CF53C01B2A2930EC2AA3AF13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader
- Size 3.8MB
- SHA256 5a9b93058484ea6e27e1ddbeca7ae31521af802a0b8f5f5674699dce6935d2c7
- MD5 df11cf4151756c42e7f0e8f72c7886e1
- SHA1 28d3687920d64148723551b33588c4c1ebbbd56c
- SHA512 ac3a3d70adcdc60d87606fe623d415e47e9770cbb2573b8143c0a4506c271fe3931bdd6a16886d9fffb74e2eea40e62050c15df5ae95da5a48cb7dbeda8bac58
- SSDEEP 98304:Q6PKbXsPN5kiXx9vuFOnYHEuK59sePl9oGoNoswfX:QKl5XjvUCPQLNmfX
- TLSH
  T1AE16C0227BD58035E4B281B16A7D9A77D57DBC340B7559CF53C01B2A2930EC2AA3AF13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery shodi persistence privilege_escalation spyware stealer trojan worm
- Detects Shodi worm
- Family: Shodi
  Shodi is a Windows worm written in C++.
  worm shodi
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2