75711f2e5bf435860448195c80b650cdc26cd92aec5386fbb04d0be817d68030

General

Target
2026-08-03_ec5ae01047852f5b8641411573d91d50_amadey_blankgrabber_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
Size 127.3MB
Sample260803-knsc5aep6t
SHA256 75711f2e5bf435860448195c80b650cdc26cd92aec5386fbb04d0be817d68030
MD5 ec5ae01047852f5b8641411573d91d50
SHA1 8e7d648a0648b08d0b83e605775cde86164f4d35
SHA512 0c037d52f49bc3d7da63e47ac8765c3d94146d8ca91cb10d38096d490febb763ff0189c2fce214186538ee07f8e867a64d1418a892e2b61218fc375d2d7a0b21
SSDEEP 786432:AaW1JhQlR7TtKeagPV1xmm0RXXcimTJdui+0uMskf0GaDmZQ+JYMJSTYT+LClkzD:AaywR7hKGvhU0sMEi+
TLSH
T1F8583A566209056AE3BFE27078664767E662791333F89C93FE4C57040BE73B23A78742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_ec5ae01047852f5b8641411573d91d50_amadey_blankgrabber_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
- Size 127.3MB
- SHA256 75711f2e5bf435860448195c80b650cdc26cd92aec5386fbb04d0be817d68030
- MD5 ec5ae01047852f5b8641411573d91d50
- SHA1 8e7d648a0648b08d0b83e605775cde86164f4d35
- SHA512 0c037d52f49bc3d7da63e47ac8765c3d94146d8ca91cb10d38096d490febb763ff0189c2fce214186538ee07f8e867a64d1418a892e2b61218fc375d2d7a0b21
- SSDEEP 786432:AaW1JhQlR7TtKeagPV1xmm0RXXcimTJdui+0uMskf0GaDmZQ+JYMJSTYT+LClkzD:AaywR7hKGvhU0sMEi+
- TLSH
  T1F8583A566209056AE3BFE27078664767E662791333F89C93FE4C57040BE73B23A78742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2