General
- Target 2026-07-09_90df9f30d666d6742d344adf8c8e52ca_aobokeylogger_bpfdoor_bumblebee_cobalt-strike_crashoverride_deltacharlie_elex_exaramel_explosive_fujinama_furtim_gh0st_glassworm_grayfish_hawkeye-keylogger_mass-logger_qilin_sakula_sorefang_speculoos_zxxz
- Size 5.0MB
- Sample260709-ptj16aav6j
- SHA256 e0ab0f79e40a298954ef310d26975d8519569be424427eb144c311896c3958a8
Score
10/10
Malware Config
Targets
-
- Target 2026-07-09_90df9f30d666d6742d344adf8c8e52ca_aobokeylogger_bpfdoor_bumblebee_cobalt-strike_crashoverride_deltacharlie_elex_exaramel_explosive_fujinama_furtim_gh0st_glassworm_grayfish_hawkeye-keylogger_mass-logger_qilin_sakula_sorefang_speculoos_zxxz
- Size 5.0MB
- SHA256 e0ab0f79e40a298954ef310d26975d8519569be424427eb144c311896c3958a8
Score10/10-
Detects NominatusCrypto DOS executable variant
-
Family: NominatusCrypto,NominatusStorm
NominatusCrypto aka NominatusStorm is a ransomware written in C#.
-
Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload
-
Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables calling ClearMyTracksByProcess
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing artifacts associated with disabling Widnows Defender
-
Detects executables containing commands for clearing Windows Event Logs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools