43210439a745be686ee79412d65476cd6ee31f06286102489febdf4998fc2895

General

Target
2026-07-20_0d5d06f3da5380a9ddcb720e05e9eb15_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
Size 14.3MB
Sample260720-zjcjfaev7n
SHA256 43210439a745be686ee79412d65476cd6ee31f06286102489febdf4998fc2895
MD5 0d5d06f3da5380a9ddcb720e05e9eb15
SHA1 4ed792b830ad03a9f3b48fedb8e159e7bcf4b1d3
SHA512 9bd581ab635f795ba40a822d76277040e5f98f53271b8b91ad2742beaf298f315624c3aa6414a4775a84882861570a397f0d2a157f756baecf04b089a5af8bfc
SSDEEP 196608:yfefPp0aDbXyhlMufpm0aDbXyhlMua0aDbXyhlMuf0aDbXyhlMu60aDbXyhlMu:iaD27MQaD27M8aD27MbaD27M0aD27M
TLSH
T1F2E61201B3DA65BAD0BB0638D87992645775BC154762C6EF53A0B96D2C33BC08E327B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-20_0d5d06f3da5380a9ddcb720e05e9eb15_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 14.3MB
- SHA256 43210439a745be686ee79412d65476cd6ee31f06286102489febdf4998fc2895
- MD5 0d5d06f3da5380a9ddcb720e05e9eb15
- SHA1 4ed792b830ad03a9f3b48fedb8e159e7bcf4b1d3
- SHA512 9bd581ab635f795ba40a822d76277040e5f98f53271b8b91ad2742beaf298f315624c3aa6414a4775a84882861570a397f0d2a157f756baecf04b089a5af8bfc
- SSDEEP 196608:yfefPp0aDbXyhlMufpm0aDbXyhlMua0aDbXyhlMuf0aDbXyhlMu60aDbXyhlMu:iaD27MQaD27M8aD27MbaD27M0aD27M
- TLSH
  T1F2E61201B3DA65BAD0BB0638D87992645775BC154762C6EF53A0B96D2C33BC08E327B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2