cdcbc81e436c34726ee510d89a20096ec026c80e1d82a90a96b5b7672d4c63ad

General

Target
2026-07-02_a3811e01eee29152059336ef98adb595_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
Size 12.2MB
Sample260702-d9fg5abv9x
SHA256 cdcbc81e436c34726ee510d89a20096ec026c80e1d82a90a96b5b7672d4c63ad
MD5 a3811e01eee29152059336ef98adb595
SHA1 d5eb85b63252f38d13518a05ff10717d2406590e
SHA512 ffd58dfeb919f9834fb9d06de488e8b1b009cbf5ce22d67b0e3209b5f4a36dd2d154b22a2e4826d72a22cf36eaf68548d79a4c8fb8f10d70ec8bc33051b3d7b3
SSDEEP 196608:+c8fefPIoHQjDSOgt6PiDoHQjDSOgtSDoHQjDSOgt2DoHQjDSOgtK:PaowXSouowXSUowXSkowXS4
TLSH
T182D61211B3D694BAD4BB0638D87A52655235BC148762C3BF6790BD6E2D32BC09E32373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-02_a3811e01eee29152059336ef98adb595_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 12.2MB
- SHA256 cdcbc81e436c34726ee510d89a20096ec026c80e1d82a90a96b5b7672d4c63ad
- MD5 a3811e01eee29152059336ef98adb595
- SHA1 d5eb85b63252f38d13518a05ff10717d2406590e
- SHA512 ffd58dfeb919f9834fb9d06de488e8b1b009cbf5ce22d67b0e3209b5f4a36dd2d154b22a2e4826d72a22cf36eaf68548d79a4c8fb8f10d70ec8bc33051b3d7b3
- SSDEEP 196608:+c8fefPIoHQjDSOgt6PiDoHQjDSOgtSDoHQjDSOgt2DoHQjDSOgtK:PaowXSouowXSUowXSkowXS4
- TLSH
  T182D61211B3D694BAD4BB0638D87A52655235BC148762C3BF6790BD6E2D32BC09E32373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2