39652ee1373c64dfbf2f538c445985efdc61f79169e212efa17f05f0a622a1f2

General

Target
2026-07-28_7248fd48120a23be8ca42c6bb05940b9_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_metamorfo_njrat
Size 148.6MB
Sample260728-bgr94svflh
SHA256 39652ee1373c64dfbf2f538c445985efdc61f79169e212efa17f05f0a622a1f2
MD5 7248fd48120a23be8ca42c6bb05940b9
SHA1 0c7ca37a5ab1ecbda8d106dfb51385f4d0823df0
SHA512 7e6485fb9dc935fbd72ba3f3311707c7adcc1c3834f1c9896e52d82ba5ec25336ad300c252d35a20618a071e49baa0f58a3543548c180cb3790980ddf3cf4668
SSDEEP 3145728:6/nwv6ocyMBGL+KQWD5FClA1h3DZVihQVUpabmViiNs59M:6/nwv2HBGRTD52BhGU3tNU6
TLSH
T14B783312B5A08074F4A33271B43C67B949227EA29B3485CFB75C7C845F786E2553A3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-28_7248fd48120a23be8ca42c6bb05940b9_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_metamorfo_njrat
- Size 148.6MB
- SHA256 39652ee1373c64dfbf2f538c445985efdc61f79169e212efa17f05f0a622a1f2
- MD5 7248fd48120a23be8ca42c6bb05940b9
- SHA1 0c7ca37a5ab1ecbda8d106dfb51385f4d0823df0
- SHA512 7e6485fb9dc935fbd72ba3f3311707c7adcc1c3834f1c9896e52d82ba5ec25336ad300c252d35a20618a071e49baa0f58a3543548c180cb3790980ddf3cf4668
- SSDEEP 3145728:6/nwv6ocyMBGL+KQWD5FClA1h3DZVihQVUpabmViiNs59M:6/nwv2HBGRTD52BhGU3tNU6
- TLSH
  T14B783312B5A08074F4A33271B43C67B949227EA29B3485CFB75C7C845F786E2553A3AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2