8041461baeeff18d56ec3c71a14eb2a2d8b83cb895b04d18fd384b78257d8295

General

Target
2026-07-08_08b67b37dcb6ef0c342c9657f14b9b7a_amadey_bazarloader_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_vidar
Size 38.0MB
Sample260708-ss397aht5x
SHA256 8041461baeeff18d56ec3c71a14eb2a2d8b83cb895b04d18fd384b78257d8295
MD5 08b67b37dcb6ef0c342c9657f14b9b7a
SHA1 350c3fd14c1e6ba174935dd311af0ba84b12b692
SHA512 acbdf5adaa156822f8687f0776cc82d9a7a08884d92dd12eda97d5c87ccd0223ecc16335d469ffba31948e3be02fc8d51d1fc6b538ea657a264e4a32f8810cc6
SSDEEP 393216:0u00QADNNk8fmtbrvGRNLSvXcDoc3LNDg24UhLr7H2Bkb:lhff6M6XGpKILr7Hem
TLSH
T14D975C229ADE00D8C4D740BD49594262BF37345687301EEB9089797A6F33AE8EE3D7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_08b67b37dcb6ef0c342c9657f14b9b7a_amadey_bazarloader_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_vidar
- Size 38.0MB
- SHA256 8041461baeeff18d56ec3c71a14eb2a2d8b83cb895b04d18fd384b78257d8295
- MD5 08b67b37dcb6ef0c342c9657f14b9b7a
- SHA1 350c3fd14c1e6ba174935dd311af0ba84b12b692
- SHA512 acbdf5adaa156822f8687f0776cc82d9a7a08884d92dd12eda97d5c87ccd0223ecc16335d469ffba31948e3be02fc8d51d1fc6b538ea657a264e4a32f8810cc6
- SSDEEP 393216:0u00QADNNk8fmtbrvGRNLSvXcDoc3LNDg24UhLr7H2Bkb:lhff6M6XGpKILr7Hem
- TLSH
  T14D975C229ADE00D8C4D740BD49594262BF37345687301EEB9089797A6F33AE8EE3D7C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Looks for Xen service registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2