f12df6c775fe63b201c6c20b9dd89fa9bdafc2bbccd9ecc98b4a6460425d551f

General

Target
2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_vidar
Size 37.9MB
Sample260708-tx5t9act7l
SHA256 f12df6c775fe63b201c6c20b9dd89fa9bdafc2bbccd9ecc98b4a6460425d551f
MD5 f51e9bc49f162fcd532b845ff3ec9de6
SHA1 6742fcf850ae6ab0a01c664a3691744be0efe2bd
SHA512 003c47be36729219e3039038e97cc031bf7c2f0a6db02860d941e40e9de256ebc2ed89ee6b73f8a29d26e8cf7d051a0616bb29a043fbfd9278a17f27a269c270
SSDEEP 393216:HuzYCDUnIvxMKOgN9l5qx40Y1MSQsq6rOhP4IXF7gwE1H:OcCiK3HMSk6rOM1H
TLSH
T1C9977D26A6D940EDC497807D0D9582A2BF337C4647309AEBD08975726E33AF4EB3D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_vidar
- Size 37.9MB
- SHA256 f12df6c775fe63b201c6c20b9dd89fa9bdafc2bbccd9ecc98b4a6460425d551f
- MD5 f51e9bc49f162fcd532b845ff3ec9de6
- SHA1 6742fcf850ae6ab0a01c664a3691744be0efe2bd
- SHA512 003c47be36729219e3039038e97cc031bf7c2f0a6db02860d941e40e9de256ebc2ed89ee6b73f8a29d26e8cf7d051a0616bb29a043fbfd9278a17f27a269c270
- SSDEEP 393216:HuzYCDUnIvxMKOgN9l5qx40Y1MSQsq6rOhP4IXF7gwE1H:OcCiK3HMSk6rOM1H
- TLSH
  T1C9977D26A6D940EDC497807D0D9582A2BF337C4647309AEBD08975726E33AF4EB3D349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Enumerates VirtualBox registry keys
  defense_evasion
- Adds policy Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare services registry key.
  defense_evasion
- Looks for Xen service registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2