coffloader | 1e2a45ba510d41e1ed67caddad379079ec40fe1e5ab6e2be63b736665feeca4f

General

Target
2026-06-07_b68408a284021debd0047ff434bf2b6a_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 13.3MB
Sample260607-c2s8ksgs2p
SHA256 1e2a45ba510d41e1ed67caddad379079ec40fe1e5ab6e2be63b736665feeca4f
MD5 b68408a284021debd0047ff434bf2b6a
SHA1 c910950ebf043cfafe6093ade22e70e0183ac90a
SHA512 c6a6f2720882ba0c38611a033a46a952845e5a9a54538a1e743d2ce18504cb312301da568a9e330772f6ae42b12116d69808f3a48f7dfc38aff952d6583c2bcd
SSDEEP 393216:E4pR2QCPLKsq+YpWhTlilBS+y161FdDEbBLhVACH69XKVHwliBWcGoY56r:EvX16JoY0r
TLSH
T1D6E6AE13B6A050B8E4A73271F43D673A8D327E629B3145CF46906CC82F796D2693A35F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-07_b68408a284021debd0047ff434bf2b6a_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 13.3MB
- SHA256 1e2a45ba510d41e1ed67caddad379079ec40fe1e5ab6e2be63b736665feeca4f
- MD5 b68408a284021debd0047ff434bf2b6a
- SHA1 c910950ebf043cfafe6093ade22e70e0183ac90a
- SHA512 c6a6f2720882ba0c38611a033a46a952845e5a9a54538a1e743d2ce18504cb312301da568a9e330772f6ae42b12116d69808f3a48f7dfc38aff952d6583c2bcd
- SSDEEP 393216:E4pR2QCPLKsq+YpWhTlilBS+y161FdDEbBLhVACH69XKVHwliBWcGoY56r:EvX16JoY0r
- TLSH
  T1D6E6AE13B6A050B8E4A73271F43D673A8D327E629B3145CF46906CC82F796D2693A35F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution coffloader loader persistence privilege_escalation spyware stealer trojan
- Detects Coffloader
- Family: Coffloader
  Coffloader is an open-source beacon loader written in C.
  loader coffloader
- Windows security bypass
  defense_evasion trojan
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables referencing many IR and analysis tools
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2