Overview

overview

10

Static

static

10

2026-07-27...er.exe

windows10-2004-x64

4

2026-07-27...er.exe

windows11-ltsc_2024-x64

4

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...up.exe

windows10-2004-x64

6

$PLUGINSDI...up.exe

windows11-ltsc_2024-x64

6

MicrosoftE...up.exe

windows10-2004-x64

6

MicrosoftE...up.exe

windows11-ltsc_2024-x64

6

TcNo-Acc-Switcher.exe

windows10-2004-x64

6

TcNo-Acc-Switcher.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-27_41b00341cb9b2f44c405771240b92ef4_amadey_cloudeye_dosia_elex_hellokitty_luca-stealer_njrat_quasar-rat_smoke-loader
  • Size 10.8MB
  • Sample260727-ec57ysgp2z
  • SHA256 75168843cac1620b3ebc5ad5717415dff392bc2eb75de9a2b66ed740b8a51c2c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Targets

    • Target
      2026-07-27_41b00341cb9b2f44c405771240b92ef4_amadey_cloudeye_dosia_elex_hellokitty_luca-stealer_njrat_quasar-rat_smoke-loader
    • Size 10.8MB
    • SHA256 75168843cac1620b3ebc5ad5717415dff392bc2eb75de9a2b66ed740b8a51c2c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsis7z.dll
    • Size 424KB
    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
    • Size 1.7MB
    • SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral10behavioral9
    • Target
      MicrosoftEdgeWebview2Setup.exe
    • Size 1.7MB
    • SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistenceprivilege_escalationdefense_evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral11behavioral12
    • Target
      TcNo-Acc-Switcher.exe
    • Size 23.8MB
    • SHA256 0a47fed677380f1e71c7bb98eebe29e66bb745c05fd15bee02cbd74f854efe6e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral13behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

2
T1553.004

Credential Access

Discovery

Network Share Discovery

1
T1135

Peripheral Device Discovery

1
T1120

Query Registry

6
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks