charmant | 2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassworm_icedid_luca-stealer_njrat_ponmocup_remcos_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassworm_icedid_luca-stealer_njrat_ponmocup_remcos_stealc_vidar
Size 126.5MB
Sample260718-l2k2msaz4v
SHA256 0a9ffaecd88d8bfd912f8be8723949f3b4054a108f3723c70ac440eaa090d355
MD5 fb3f2dcb4f1bfbc092df7e13b0a982f1
SHA1 0f3f7aa9cf269230b5639513d159574fe599fd41
SHA512 38e0db6c86483f45286bcc5a41094310b2ae28972e2c3405485557282a139f617cdf1ceea686674e5e88cdf3221ef2037d12732bc0939ac4118d3f8a46392532
SSDEEP 1572864:ZpN0oHOKVPl1CVUuQ2fDVHoYEGh6jonw8mkLydbf7aw4IMmrRLSlKvcD:Z7vHbVP3CCULOHjonw8mkLyD4BKLSli
TLSH
T18058D01A77EC0154E1BBC13C8577862AE6B2B8215B2197CF2160863D5F77FE14E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware charmant

Malware Config

Signatures

Family: Charmant
Charmant is a Windows ransomware written in C#.
ransomware charmant

Detects Charmant ransomware 1 IoCs

resource	yara_rule
sample	family_charmant

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassworm_icedid_luca-stealer_njrat_ponmocup_remcos_stealc_vidar

File Explorer

2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassworm_icedid_luca-stealer_njrat_ponmocup_remcos_stealc_vidar

.exe 126.5MB

2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassworm_icedid_luca-stealer_njrat_ponmocup_remcos_stealc_vidar

IMPHASH 192bf4d39772e2fb47bdc7367ddc86eb
SHA256 0a9ffaecd88d8bfd912f8be8723949f3b4054a108f3723c70ac440eaa090d355
MD5 fb3f2dcb4f1bfbc092df7e13b0a982f1
SHA1 0f3f7aa9cf269230b5639513d159574fe599fd41
SHA512 38e0db6c86483f45286bcc5a41094310b2ae28972e2c3405485557282a139f617cdf1ceea686674e5e88cdf3221ef2037d12732bc0939ac4118d3f8a46392532
SSDEEP 1572864:ZpN0oHOKVPl1CVUuQ2fDVHoYEGh6jonw8mkLydbf7aw4IMmrRLSlKvcD:Z7vHbVP3CCULOHjonw8mkLyD4BKLSli
TLSH
T18058D01A77EC0154E1BBC13C8577862AE6B2B8215B2197CF2160863D5F77FE14E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Charmant ransomware
Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ord17

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendInput SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW GetFileSize GetFileType GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetPrivateProfileStringW GetProcAddress GetProcessHeap GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW LoadResource LocalAlloc LocalFree LockResource MoveFileExW MoveFileW MulDiv MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReadFile RemoveDirectoryW RtlUnwind SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

Name

.text

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

2KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15.3MB

Virtual Size

15.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassworm_icedid_luca-stealer_njrat_ponmocup_remcos_stealc_vidar

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic