f9fc754d64a26acb4e057165953d21ddfbf44c059c7d59fdcafe3862be4e4fd7

General

Target
2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
Size 127.1MB
Sample260803-kldryssaqa
SHA256 f9fc754d64a26acb4e057165953d21ddfbf44c059c7d59fdcafe3862be4e4fd7
MD5 fc77fe21c920c2023566a9527973f48d
SHA1 f820e4b90718b3c653ee81e8db1af8323d61a682
SHA512 9325b37479bd98f00b0b4312da99ad3eaf673ce9c335eea5522519845df2ad737a546c927ab788c3a44b30ab4f91befb588cbc81a0f792c251e64baee7ed2654
SSDEEP 786432:M9HlkOm67XdIxO1Miq0RXXcimTJdui+0uMskf0GaDmZQ+JYMJSTYT+LClkzsbDHG:M9HlkOj7XOEMPhU0sMEii
TLSH
T1EE582A566249056AE3FFE27078664667E662791333F89C83FE4C57040BEB3B23A78741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 127.1MB
- SHA256 f9fc754d64a26acb4e057165953d21ddfbf44c059c7d59fdcafe3862be4e4fd7
- MD5 fc77fe21c920c2023566a9527973f48d
- SHA1 f820e4b90718b3c653ee81e8db1af8323d61a682
- SHA512 9325b37479bd98f00b0b4312da99ad3eaf673ce9c335eea5522519845df2ad737a546c927ab788c3a44b30ab4f91befb588cbc81a0f792c251e64baee7ed2654
- SSDEEP 786432:M9HlkOm67XdIxO1Miq0RXXcimTJdui+0uMskf0GaDmZQ+JYMJSTYT+LClkzsbDHG:M9HlkOj7XOEMPhU0sMEii
- TLSH
  T1EE582A566249056AE3FFE27078664667E662791333F89C83FE4C57040BEB3B23A78741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2