General
- Target 2026-07-10_552a85b4055f0b68de92c304f3c4c532_amadey_coinminer_elex_glassworm_icedid_karagany_luca-stealer_njrat_poet-rat_rhadamanthys_smoke-loader_stop
- Size 30.7MB
- Sample260710-y8c1tsbs5w
- SHA256 150d738af980d8caf24e1cb7eacee68d7b3ce92b66a8086bca4a7b447fb93a03
Score
10/10
Malware Config
Targets
-
- Target 2026-07-10_552a85b4055f0b68de92c304f3c4c532_amadey_coinminer_elex_glassworm_icedid_karagany_luca-stealer_njrat_poet-rat_rhadamanthys_smoke-loader_stop
- Size 30.7MB
- SHA256 150d738af980d8caf24e1cb7eacee68d7b3ce92b66a8086bca4a7b447fb93a03
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.