shodi | 0a7b8ad8d3fd09f6db7d65f21b81370ded541099e14dbba5262e7f1ff1a64d3b

General

Target
2026-07-05_89974841397b0a150e1a068a1229c945_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_nymaim_rhadamanthys_smoke-loader
Size 1.9MB
Sample260705-d8ejfacx9k
SHA256 0a7b8ad8d3fd09f6db7d65f21b81370ded541099e14dbba5262e7f1ff1a64d3b
MD5 89974841397b0a150e1a068a1229c945
SHA1 d70742b1121254127770668eaff31b13bb719ec0
SHA512 5bf51d79ac026861104a12d8e4a1a7ca74f611021cf22b74a4c1f5483d1b518f0d5f71129d5840b13e8a8758d9ec5511d0e241b3f0b2fb7ca80f51ae9e233e4a
SSDEEP 49152:nK51rgXteP3hK51rgXteP3Vz9oI2mhoNosVDP+fX3:nK59sePxK59sePl9oGoNoswfn
TLSH
T154951205BAD18071E0B61A310574CEB1977DFC701B60AB9FA7852E782F31DC1DA3A76A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-05_89974841397b0a150e1a068a1229c945_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_nymaim_rhadamanthys_smoke-loader
- Size 1.9MB
- SHA256 0a7b8ad8d3fd09f6db7d65f21b81370ded541099e14dbba5262e7f1ff1a64d3b
- MD5 89974841397b0a150e1a068a1229c945
- SHA1 d70742b1121254127770668eaff31b13bb719ec0
- SHA512 5bf51d79ac026861104a12d8e4a1a7ca74f611021cf22b74a4c1f5483d1b518f0d5f71129d5840b13e8a8758d9ec5511d0e241b3f0b2fb7ca80f51ae9e233e4a
- SSDEEP 49152:nK51rgXteP3hK51rgXteP3Vz9oI2mhoNosVDP+fX3:nK59sePxK59sePl9oGoNoswfn
- TLSH
  T154951205BAD18071E0B61A310574CEB1977DFC701B60AB9FA7852E782F31DC1DA3A76A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery shodi persistence privilege_escalation spyware stealer trojan worm
- Detects Shodi worm
- Family: Shodi
  Shodi is a Windows worm written in C++.
  worm shodi
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2