8d9c02261231d6552007ceebd1a0319f1fb4632ab6711de19d4653578048b330

General

Target
2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
Size 12.6MB
Sample260710-n7wrfaaz3j
SHA256 8d9c02261231d6552007ceebd1a0319f1fb4632ab6711de19d4653578048b330
MD5 0b1e7c08c19b125dc1efbe1fbb17e6f0
SHA1 fe50b923582ec746fd7edb9c0e58b62b9f90988c
SHA512 a3cef3ae9416bad3422fe1c6001b835120bd88f0c36c30169e8d2418c8e794fcc4d3b1dd6993d845d85b3788be271980650d92fdf2e4f187b6c0e27c32ad984f
SSDEEP 98304:+RDRs6efPwypiTBNxNBWHPGS0h7276EpiTBNxNBWHmpiTBNxNBWHqpiTBNxNBWHT:+RdfefPwyK5OqyRK5xK57K5sK5xK5R
TLSH
T108D61201B3EA4979E5BF0A78E87A41549B35BC049B12C6BF53947D6D2D32BC089323B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 12.6MB
- SHA256 8d9c02261231d6552007ceebd1a0319f1fb4632ab6711de19d4653578048b330
- MD5 0b1e7c08c19b125dc1efbe1fbb17e6f0
- SHA1 fe50b923582ec746fd7edb9c0e58b62b9f90988c
- SHA512 a3cef3ae9416bad3422fe1c6001b835120bd88f0c36c30169e8d2418c8e794fcc4d3b1dd6993d845d85b3788be271980650d92fdf2e4f187b6c0e27c32ad984f
- SSDEEP 98304:+RDRs6efPwypiTBNxNBWHPGS0h7276EpiTBNxNBWHmpiTBNxNBWHqpiTBNxNBWHT:+RdfefPwyK5OqyRK5xK57K5sK5xK5R
- TLSH
  T108D61201B3EA4979E5BF0A78E87A41549B35BC049B12C6BF53947D6D2D32BC089323B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence ransomware rat adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2