fb4e43372ac500f056ce8d4bdde86366fe288e5a3a9e8e8ee124016698ebc9d9

General

Target
2026-07-08_992765fc02c394343b72a9ab15b9b546_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
Size 5.7MB
Sample260708-nbgyeaex3t
SHA256 fb4e43372ac500f056ce8d4bdde86366fe288e5a3a9e8e8ee124016698ebc9d9
MD5 992765fc02c394343b72a9ab15b9b546
SHA1 d0b612d84af41eb55b5046d0c91ff3fe11346513
SHA512 690b2355b589f9ee3648d34195de876c292e5008e3c436d0f4ec08b5ea043ece00e2f17d0d909b4923b0adb4e7d9cfd3c51c536363c7c7e7990d685dc8ea2670
SSDEEP 98304:ztSuMOINjO91x364DTZTx4NVMFb/55PU/yOtoDw/z:YMJUM9/5RwWA
TLSH
T1B556C001FB8585F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-08_992765fc02c394343b72a9ab15b9b546_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
- Size 5.7MB
- SHA256 fb4e43372ac500f056ce8d4bdde86366fe288e5a3a9e8e8ee124016698ebc9d9
- MD5 992765fc02c394343b72a9ab15b9b546
- SHA1 d0b612d84af41eb55b5046d0c91ff3fe11346513
- SHA512 690b2355b589f9ee3648d34195de876c292e5008e3c436d0f4ec08b5ea043ece00e2f17d0d909b4923b0adb4e7d9cfd3c51c536363c7c7e7990d685dc8ea2670
- SSDEEP 98304:ztSuMOINjO91x364DTZTx4NVMFb/55PU/yOtoDw/z:YMJUM9/5RwWA
- TLSH
  T1B556C001FB8585F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery persistence ransomware spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2