79fb55612d3affa779809752ea6c9cfa9d570154291651af49f0505898ad4cfe

General

Target
2026-07-23_907b920d05228c91f01d7c44188c13fa_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
Size 5.6MB
Sample260723-s8j69afl7s
SHA256 79fb55612d3affa779809752ea6c9cfa9d570154291651af49f0505898ad4cfe
MD5 907b920d05228c91f01d7c44188c13fa
SHA1 460ceaea5693e5d82c7ade8cb6855c1a5301d4ca
SHA512 7cecf61443cccfff135ef4ed32ad2208d49eeebff641a7bdb137bd44299ca996d511bdcf827afab9a1259397f8c3feb067cd26ad553ce69d659e55c8d261e3c8
SSDEEP 98304:/zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:/hfefPtHxcp9ym3nltDUJV
TLSH
T10D56E101B3D695B6D1BF1638D87A52696634BC049316CBFF5394BD392E32BC04E323A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-23_907b920d05228c91f01d7c44188c13fa_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 5.6MB
- SHA256 79fb55612d3affa779809752ea6c9cfa9d570154291651af49f0505898ad4cfe
- MD5 907b920d05228c91f01d7c44188c13fa
- SHA1 460ceaea5693e5d82c7ade8cb6855c1a5301d4ca
- SHA512 7cecf61443cccfff135ef4ed32ad2208d49eeebff641a7bdb137bd44299ca996d511bdcf827afab9a1259397f8c3feb067cd26ad553ce69d659e55c8d261e3c8
- SSDEEP 98304:/zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:/hfefPtHxcp9ym3nltDUJV
- TLSH
  T10D56E101B3D695B6D1BF1638D87A52696634BC049316CBFF5394BD392E32BC04E323A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2