493d00cf9ae7c320ccf86ab4d43d55d656b8f60f77e062a2912dd15f95bd3193

General

Target
2026-08-01_941db9c91e6ebe0371860db3b3dca0ee_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
Size 18.5MB
Sample260802-ajdn3azhjc
SHA256 493d00cf9ae7c320ccf86ab4d43d55d656b8f60f77e062a2912dd15f95bd3193
MD5 941db9c91e6ebe0371860db3b3dca0ee
SHA1 8c2393a56fa3cd6049acd5a4241cd5bb523070f0
SHA512 8fa5a104e4450dd24a64be360a7b35b0e47c52b83798c49bf56f019167825218c9375c03f9af55c610c08a052013e2924a703f3d971cb7a803548cc0fabd00c6
SSDEEP 393216:Iq5VDBCDxtQELq5VDBCDxzq5VDBCDxeq5VDBCDxnq5VDBCDx5q5VDBCDxYq5VDB9:IpkELpFpQpZp/pCpu
TLSH
T153172312B3E59475D0BB0639D83A53656B35BC008B65C66F2394B86D2D33BC0CA727BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-01_941db9c91e6ebe0371860db3b3dca0ee_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
- Size 18.5MB
- SHA256 493d00cf9ae7c320ccf86ab4d43d55d656b8f60f77e062a2912dd15f95bd3193
- MD5 941db9c91e6ebe0371860db3b3dca0ee
- SHA1 8c2393a56fa3cd6049acd5a4241cd5bb523070f0
- SHA512 8fa5a104e4450dd24a64be360a7b35b0e47c52b83798c49bf56f019167825218c9375c03f9af55c610c08a052013e2924a703f3d971cb7a803548cc0fabd00c6
- SSDEEP 393216:Iq5VDBCDxtQELq5VDBCDxzq5VDBCDxeq5VDBCDxnq5VDBCDx5q5VDBCDxYq5VDB9:IpkELpFpQpZp/pCpu
- TLSH
  T153172312B3E59475D0BB0639D83A53656B35BC008B65C66F2394B86D2D33BC0CA727BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Detects encrypted or obfuscated .NET executables
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2