90c67fb2a595ee11f0cbfb218c49a0032966ef0b11e638489a430952d60184e5

General

Target
2026-07-18_60f464a6c20983b3d7a4f9925d8aa46e_destroyer_elex_glassworm_ngrbot_wannacry
Size 52KB
Sample260718-1lmb4agv2t
SHA256 90c67fb2a595ee11f0cbfb218c49a0032966ef0b11e638489a430952d60184e5
MD5 60f464a6c20983b3d7a4f9925d8aa46e
SHA1 6e5a270497f21daa470d83df1f69aee35a3ba3a0
SHA512 84116607de157f432a68a5f67cfd5baa5b49103a9481322a2959296a7d4ce1ac3aff35b17d51e1ff7c63523e3cc49bf8d7fdaad0db5f0bad6245afcc36ca8f81
SSDEEP 768:xVTtLYhD+7o19oDJLnk5z9SYZ5d/qju9XeNunhNe07LPLf9jSabhE2Q:tYhD+Yuhn3enqju9XeNT0zljSab7Q
TLSH
T10D33084837ED4512E1BF4BBE997180529372F463DD22DB8E0AD8459E09F3B44CC68B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-18_60f464a6c20983b3d7a4f9925d8aa46e_destroyer_elex_glassworm_ngrbot_wannacry
- Size 52KB
- SHA256 90c67fb2a595ee11f0cbfb218c49a0032966ef0b11e638489a430952d60184e5
- MD5 60f464a6c20983b3d7a4f9925d8aa46e
- SHA1 6e5a270497f21daa470d83df1f69aee35a3ba3a0
- SHA512 84116607de157f432a68a5f67cfd5baa5b49103a9481322a2959296a7d4ce1ac3aff35b17d51e1ff7c63523e3cc49bf8d7fdaad0db5f0bad6245afcc36ca8f81
- SSDEEP 768:xVTtLYhD+7o19oDJLnk5z9SYZ5d/qju9XeNunhNe07LPLf9jSabhE2Q:tYhD+Yuhn3enqju9XeNT0zljSab7Q
- TLSH
  T10D33084837ED4512E1BF4BBE997180529372F463DD22DB8E0AD8459E09F3B44CC68B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Custom signature
  
  Detects command variations typically used by ransomware
- Custom signature
  
  Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2