2da496725ce6dac07a4183ee03153a1983d377b30b20195f31c29c031e5d861b

General

Target
2026-07-04_cdffec0303cc5c45d350b227e2926b38_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
Size 4.1MB
Sample260704-vxajsaet8j
SHA256 2da496725ce6dac07a4183ee03153a1983d377b30b20195f31c29c031e5d861b
MD5 cdffec0303cc5c45d350b227e2926b38
SHA1 af09db07276a31de8f912d5a4fe1671fdc7b32dd
SHA512 7021b67c55ea81392674634663303a93d318ea2580d44832eaf1a00f19938a8ffaf1289fc8a039ea593a12e67c299492b833784ce14bdade0ab713d5a14ec5fe
SSDEEP 49152:IupHrfi963PSumT0+TFiH7efPp3Z01NSdTNWta7zHzqBGBdJDTf2IhLlSXGulwEK:IOHC6+6efPY2dTNCAzTqBcJT2GSwEYCG
TLSH
T17B16D011B3D181B5D1BF0638D8B94666A774BC088361CBAF5794BD796E32BC08E22377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-04_cdffec0303cc5c45d350b227e2926b38_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 4.1MB
- SHA256 2da496725ce6dac07a4183ee03153a1983d377b30b20195f31c29c031e5d861b
- MD5 cdffec0303cc5c45d350b227e2926b38
- SHA1 af09db07276a31de8f912d5a4fe1671fdc7b32dd
- SHA512 7021b67c55ea81392674634663303a93d318ea2580d44832eaf1a00f19938a8ffaf1289fc8a039ea593a12e67c299492b833784ce14bdade0ab713d5a14ec5fe
- SSDEEP 49152:IupHrfi963PSumT0+TFiH7efPp3Z01NSdTNWta7zHzqBGBdJDTf2IhLlSXGulwEK:IOHC6+6efPY2dTNCAzTqBcJT2GSwEYCG
- TLSH
  T17B16D011B3D181B5D1BF0638D8B94666A774BC088361CBAF5794BD796E32BC08E22377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Detects encrypted or obfuscated .NET executables
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2