0b11a7fc16e739b25d3b1c5c4b961119a79b6a26e736786c6b358f7e41918ff7

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_61b5d3093dcaf035a6d1638247285c18_cloudeye_cobalt-strike_coinminer_elex_glassworm_icedid_konni_luca-stealer_njrat_poet-rat_remcos_stealc_vidar
Size 112.5MB
Sample260718-nbjf8shv8k
SHA256 0b11a7fc16e739b25d3b1c5c4b961119a79b6a26e736786c6b358f7e41918ff7
MD5 61b5d3093dcaf035a6d1638247285c18
SHA1 8dd784cadc8cf6a37a4af8d7873e5a28090b9f6c
SHA512 a2eaa1e812a32df55cd1d6ab05c9979654e3e654cf092599ebee140acbad7d6633f8f7ffdb54bc1a1d7f2b2fc6d7716b3276e09e07d385a8a4db5616e8c8e09a
SSDEEP 786432:u6ecoleVCATiyN/6/jzN1mJOU+adA0+SC:u62ICALN/CzfmJTfA0+h
TLSH
T1F7487C1A63EC0195E47BD138C5A78A0AE7B27C21273197CF01A0A67D5F37BE45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-18_61b5d3093dcaf035a6d1638247285c18_cloudeye_cobalt-strike_coinminer_elex_glassworm_icedid_konni_luca-stealer_njrat_poet-rat_remcos_stealc_vidar
- Size 112.5MB
- SHA256 0b11a7fc16e739b25d3b1c5c4b961119a79b6a26e736786c6b358f7e41918ff7
- MD5 61b5d3093dcaf035a6d1638247285c18
- SHA1 8dd784cadc8cf6a37a4af8d7873e5a28090b9f6c
- SHA512 a2eaa1e812a32df55cd1d6ab05c9979654e3e654cf092599ebee140acbad7d6633f8f7ffdb54bc1a1d7f2b2fc6d7716b3276e09e07d385a8a4db5616e8c8e09a
- SSDEEP 786432:u6ecoleVCATiyN/6/jzN1mJOU+adA0+SC:u62ICALN/CzfmJTfA0+h
- TLSH
  T1F7487C1A63EC0195E47BD138C5A78A0AE7B27C21273197CF01A0A67D5F37BE45E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/DcryptDll.dll
- Size 18KB
- SHA256 4b9a6ad0304f08a62bdac5279176a964ca39b83354eb9f7e11a919493e7d1764
- MD5 8ce7607bd6e1a01c586ac0acbef4bc0d
- SHA1 386e0d62ac25ffcfc780888a45b5401df80adeb6
- SHA512 44a0ae1c7343c955c99d7cf01dd6af20ce4bc1df37079b4f4e8b7dde9811e19175c93d9cf9c4b4351280f8fcc3df7e10ecdd6c267e15aedcd3b4509caeafa8cc
- SSDEEP 384:oOU2E25y4n862yBmVq6nmWRJTpCLXXCXQMWfyq:oOUzz4n8ZyBmVVVpCLXSXQMWR
- TLSH
  T1DB820B11C9E0447CF2B1333976B6A916DCBD7D700476C20FFE99059F0A74A872A4A772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 12KB
- SHA256 752c9e996c732e92411788bab0c793c14975b0b06c5bfabcecb278a8ad7a920d
- MD5 009c6a9cde630ed917edaae7cb62b341
- SHA1 26aa4a58e07ccd82e34e21218e3a583234a69ca0
- SHA512 a0fbfec728eb957661e66814bd3ebb5df145c064cba65dd554865f3d8b61638b1f5d12405091da89847e044b0be8975ee6a7425371b66d91391644a130b01ba4
- SSDEEP 384:AKlm7i+c3QW6ckPhyDEaLn/2bbBBIXwZ:1qi8BcyhEhLebbTI
- TLSH
  T16F422952538998F3E788013970933707AB4692266951AED1CA334FDB7A7708D7FB5383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 11969dabc95ea649eb95d22d612dcc3e7b52e7b70c612d7708ae65970e468ce6
- MD5 9a08cb8543359cb949ea560b7e09142d
- SHA1 086f4496340a15ab09b61f17c204cde7ab48e458
- SHA512 4036b1d1092ef2320339e7665b803c7a12969accfa469598879a022e0fac4ae352a9408f364759f4054d69fe731d948700d6375b34fcada92156b76b7484cba5
- SSDEEP 96:GaX1XJXT0HmzbGVBHdMeLTOKcbI2NaeI0YqNnqN3rCUTEVXWpbc:G4x1YHm3GVBHd3OKcbIs1zEZrCUTEVXi
- TLSH
  T1A6C109B7B2D23DF2C64E0A763C11206757B4D4251B680144EEB71BC27E82EA3EC3428E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8