14eecfcc72817a736819dc343d3328d3cbc55193f3977e8bd8d45b2faad90542

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_a85573602e05f21667b81e2048d3e214_akira_amadey_cloudeye_coinminer_elex_glassworm_icedid_konni_luca-stealer_njrat_remcos_stealc_vidar_wannacry
Size 129.2MB
Sample260720-xpy9aadz7s
SHA256 14eecfcc72817a736819dc343d3328d3cbc55193f3977e8bd8d45b2faad90542
MD5 a85573602e05f21667b81e2048d3e214
SHA1 5a0532fa850f205a17b76cfe74d567f6ebcb1b2c
SHA512 953bff769bd3c3692a8eac097b3679617e500612467cba8df2f90305ba54d5c31224d09142aae92d827251b3eab8e908ebbb94c183cae91ba72f3fc48b6033cb
SSDEEP 1572864:LkR22nSPu1ZeQ2OGdXRIsLQMYyoC9s/tXCxBpT:qO21VvqhIsLQrv8T
TLSH
T18C589D1AB3EC00A5E0BAD17D85778206E7727C25173192DF21A4E2BD5F37BD06A39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-20_a85573602e05f21667b81e2048d3e214_akira_amadey_cloudeye_coinminer_elex_glassworm_icedid_konni_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 129.2MB
- SHA256 14eecfcc72817a736819dc343d3328d3cbc55193f3977e8bd8d45b2faad90542
- MD5 a85573602e05f21667b81e2048d3e214
- SHA1 5a0532fa850f205a17b76cfe74d567f6ebcb1b2c
- SHA512 953bff769bd3c3692a8eac097b3679617e500612467cba8df2f90305ba54d5c31224d09142aae92d827251b3eab8e908ebbb94c183cae91ba72f3fc48b6033cb
- SSDEEP 1572864:LkR22nSPu1ZeQ2OGdXRIsLQMYyoC9s/tXCxBpT:qO21VvqhIsLQrv8T
- TLSH
  T18C589D1AB3EC00A5E0BAD17D85778206E7727C25173192DF21A4E2BD5F37BD06A39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/DcryptDll.dll
- Size 18KB
- SHA256 4b9a6ad0304f08a62bdac5279176a964ca39b83354eb9f7e11a919493e7d1764
- MD5 8ce7607bd6e1a01c586ac0acbef4bc0d
- SHA1 386e0d62ac25ffcfc780888a45b5401df80adeb6
- SHA512 44a0ae1c7343c955c99d7cf01dd6af20ce4bc1df37079b4f4e8b7dde9811e19175c93d9cf9c4b4351280f8fcc3df7e10ecdd6c267e15aedcd3b4509caeafa8cc
- SSDEEP 384:oOU2E25y4n862yBmVq6nmWRJTpCLXXCXQMWfyq:oOUzz4n8ZyBmVVVpCLXSXQMWR
- TLSH
  T1DB820B11C9E0447CF2B1333976B6A916DCBD7D700476C20FFE99059F0A74A872A4A772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 12KB
- SHA256 752c9e996c732e92411788bab0c793c14975b0b06c5bfabcecb278a8ad7a920d
- MD5 009c6a9cde630ed917edaae7cb62b341
- SHA1 26aa4a58e07ccd82e34e21218e3a583234a69ca0
- SHA512 a0fbfec728eb957661e66814bd3ebb5df145c064cba65dd554865f3d8b61638b1f5d12405091da89847e044b0be8975ee6a7425371b66d91391644a130b01ba4
- SSDEEP 384:AKlm7i+c3QW6ckPhyDEaLn/2bbBBIXwZ:1qi8BcyhEhLebbTI
- TLSH
  T16F422952538998F3E788013970933707AB4692266951AED1CA334FDB7A7708D7FB5383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 11969dabc95ea649eb95d22d612dcc3e7b52e7b70c612d7708ae65970e468ce6
- MD5 9a08cb8543359cb949ea560b7e09142d
- SHA1 086f4496340a15ab09b61f17c204cde7ab48e458
- SHA512 4036b1d1092ef2320339e7665b803c7a12969accfa469598879a022e0fac4ae352a9408f364759f4054d69fe731d948700d6375b34fcada92156b76b7484cba5
- SSDEEP 96:GaX1XJXT0HmzbGVBHdMeLTOKcbI2NaeI0YqNnqN3rCUTEVXWpbc:G4x1YHm3GVBHd3OKcbIs1zEZrCUTEVXi
- TLSH
  T1A6C109B7B2D23DF2C64E0A763C11206757B4D4251B680144EEB71BC27E82EA3EC3428E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8