General
- Target dd4a42a839f32c1a9e6583491cf78194292c5d6f2dd6e3c654b5f0326dd0aa31
- Size 929KB
- Sample260707-v5wf8aax9w
- SHA256 dd4a42a839f32c1a9e6583491cf78194292c5d6f2dd6e3c654b5f0326dd0aa31
Score
8/10
Malware Config
Targets
-
- Target Glow_v25.15/Glow_x64.exe
- Size 1.4MB
- SHA256 189ddfe3ff3b2d1b4a51865fe876fe8e2e6635f905ad8f36374afdf9d45e3f82
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory