a72012d012a42d6e14c719e66cda5c66b602322a2632ff9c82324c33b3e8109a

General

Target
2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
Size 14.2MB
Sample260708-wf7cvsdy9j
SHA256 a72012d012a42d6e14c719e66cda5c66b602322a2632ff9c82324c33b3e8109a
MD5 5c2896d6c6549243fe74a339236776ac
SHA1 f5c2b6d9bfb29974fd25f023edb4ef13bf967e32
SHA512 8bd674cae20186044bdfacd4c9c5efacea865ec1d82a65151c3ac24fe16e93a49a0ac3595dcb35f2678f1f7f8a99516fb87f3b5ebcc7db4af3196503eb600fd7
SSDEEP 393216:KCXvI5MvHxmJwCXvI5MvHxgCXvI5MvHxaCXvI5MvHx2CXvI5MvHxe:KZ6HxvZ6HxgZ6HxaZ6Hx2Z6Hxe
TLSH
T161E62211B3E595B6D0BF1678E87D92658631FC144722C2AF53A4B96E2C32BC08E32777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 14.2MB
- SHA256 a72012d012a42d6e14c719e66cda5c66b602322a2632ff9c82324c33b3e8109a
- MD5 5c2896d6c6549243fe74a339236776ac
- SHA1 f5c2b6d9bfb29974fd25f023edb4ef13bf967e32
- SHA512 8bd674cae20186044bdfacd4c9c5efacea865ec1d82a65151c3ac24fe16e93a49a0ac3595dcb35f2678f1f7f8a99516fb87f3b5ebcc7db4af3196503eb600fd7
- SSDEEP 393216:KCXvI5MvHxmJwCXvI5MvHxgCXvI5MvHxaCXvI5MvHx2CXvI5MvHxe:KZ6HxvZ6HxgZ6HxaZ6Hx2Z6Hxe
- TLSH
  T161E62211B3E595B6D0BF1678E87D92658631FC144722C2AF53A4B96E2C32BC08E32777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat adware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2