3c56e4e9ccc7a1e6441f36b95f13d6566da8a8c11211936dd7efc81a5c5d8359

General

Target
2026-07-07_ef5636f2fa38607606660f013ea385eb_destroyer_elex_glassworm_ngrbot_wannacry
Size 51KB
Sample260707-2casdae17z
SHA256 3c56e4e9ccc7a1e6441f36b95f13d6566da8a8c11211936dd7efc81a5c5d8359
MD5 ef5636f2fa38607606660f013ea385eb
SHA1 ef1299fc2d6dd34eab65445a86fde97703c7acc6
SHA512 92b42ec7fb8fc12d903f61e50e2b8dd504bf16bc15d53f810f562e7f1b3ecd3f194cec353185790157ce76123709dee9fbc20dde04c5de3f3a3aca1fb4b26bb1
SSDEEP 768:h1SY4OWQbuoc46OXHQ7JOalKp+X+nLV//JT90fXIyf5hcFkv:X+QbvxXHiJWJ/IPRfDcFkv
TLSH
T11633E64937ED4111E2BF9ABE99B251118732F4539C33DB8E1AC5419E09F3B408DA8F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-07_ef5636f2fa38607606660f013ea385eb_destroyer_elex_glassworm_ngrbot_wannacry
- Size 51KB
- SHA256 3c56e4e9ccc7a1e6441f36b95f13d6566da8a8c11211936dd7efc81a5c5d8359
- MD5 ef5636f2fa38607606660f013ea385eb
- SHA1 ef1299fc2d6dd34eab65445a86fde97703c7acc6
- SHA512 92b42ec7fb8fc12d903f61e50e2b8dd504bf16bc15d53f810f562e7f1b3ecd3f194cec353185790157ce76123709dee9fbc20dde04c5de3f3a3aca1fb4b26bb1
- SSDEEP 768:h1SY4OWQbuoc46OXHQ7JOalKp+X+nLV//JT90fXIyf5hcFkv:X+QbvxXHiJWJ/IPRfDcFkv
- TLSH
  T11633E64937ED4111E2BF9ABE99B251118732F4539C33DB8E1AC5419E09F3B408DA8F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects ransomware indicator
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2