c984299660c347cfb7e33c9a659dabbf6cca8a101e18491653d5bf43b7938243

General

Target
2026-08-03_bd584cad17015ecefc1e3de56e6b8bf7_amadey_blankgrabber_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
Size 127.3MB
Sample260803-kvl5pasdmb
SHA256 c984299660c347cfb7e33c9a659dabbf6cca8a101e18491653d5bf43b7938243
MD5 bd584cad17015ecefc1e3de56e6b8bf7
SHA1 f885eaccf1bcff43d9dfa57316abc88370765273
SHA512 443bc5ee01dc22dd79e10ade3a86f714a3167fa9d737dfdf0bf24c1d7f041368a222ca19985da13fb1cb38a91c5e7baf01cf4be51f50b99f974b020194dd59f0
SSDEEP 786432:AaW1JhQlR7TtKeagPV17mq0RXXcimTJdui+0uMskf0GaDmZQ+JYMJSTYT+LClkzr:AaywR7hKGJhU0sMEiG
TLSH
T1F9583A566209056AE3BFE27078664767E662791333F89C93FE4C57040BE73B23A78742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_bd584cad17015ecefc1e3de56e6b8bf7_amadey_blankgrabber_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
- Size 127.3MB
- SHA256 c984299660c347cfb7e33c9a659dabbf6cca8a101e18491653d5bf43b7938243
- MD5 bd584cad17015ecefc1e3de56e6b8bf7
- SHA1 f885eaccf1bcff43d9dfa57316abc88370765273
- SHA512 443bc5ee01dc22dd79e10ade3a86f714a3167fa9d737dfdf0bf24c1d7f041368a222ca19985da13fb1cb38a91c5e7baf01cf4be51f50b99f974b020194dd59f0
- SSDEEP 786432:AaW1JhQlR7TtKeagPV17mq0RXXcimTJdui+0uMskf0GaDmZQ+JYMJSTYT+LClkzr:AaywR7hKGJhU0sMEiG
- TLSH
  T1F9583A566209056AE3BFE27078664767E662791333F89C93FE4C57040BE73B23A78742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2