dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2

General

Target
2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
Size 5.4MB
Sample260630-rtms6ahs5r
SHA256 dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2
MD5 b62119f0ae9ad41612f252dd703799d4
SHA1 a54e21752a34a4663cef87b75efe74be139a2c8e
SHA512 72e5aec6dc85f63715e078e7b1711dfdcbfa17f4a7caae6e9d76c6a06f2b06c050335c2e9486f27deed970e6ac97bce74d63343a5fbe3725944c6e122c55f60f
SSDEEP 49152:gEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:JEs6efPNwJ4t1h0cG5FGJRPxow8O
TLSH
T15546F111B3D995BAD47F0538D87A426A9A74BC045712CBEF53D4BD2D2E32BC04E323A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 5.4MB
- SHA256 dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2
- MD5 b62119f0ae9ad41612f252dd703799d4
- SHA1 a54e21752a34a4663cef87b75efe74be139a2c8e
- SHA512 72e5aec6dc85f63715e078e7b1711dfdcbfa17f4a7caae6e9d76c6a06f2b06c050335c2e9486f27deed970e6ac97bce74d63343a5fbe3725944c6e122c55f60f
- SSDEEP 49152:gEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:JEs6efPNwJ4t1h0cG5FGJRPxow8O
- TLSH
  T15546F111B3D995BAD47F0538D87A426A9A74BC045712CBEF53D4BD2D2E32BC04E323A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2