beb15f42ad4a619558a7209856939e2d231d6c410b794000a3438fb3645310ce

General

Target
2026-08-03_88d2df5a0d5fcfaabe5385947720f7b0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
Size 16.4MB
Sample260804-m23gcstyfx
SHA256 beb15f42ad4a619558a7209856939e2d231d6c410b794000a3438fb3645310ce
MD5 88d2df5a0d5fcfaabe5385947720f7b0
SHA1 0b66be9372d541cd59cd320074cb5c60536e8e87
SHA512 6c46525bbb216dbef14cf1e79c6c0a939b483eefd24c7d3807846a6ab64078bb615f550c4f458a3ac22eb276d82a7fd31f85b2fd6385e6413ee1bfa68c62e86e
SSDEEP 393216:FEowXS58owXS1owXS1owXSbowXSQowXSU:Kon58on1on1onbonQonU
TLSH
T10D071211B3E694BAD4BB0638D87A62655236BC148752C3BF5690BD6E2D32BC0DD32373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_88d2df5a0d5fcfaabe5385947720f7b0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
- Size 16.4MB
- SHA256 beb15f42ad4a619558a7209856939e2d231d6c410b794000a3438fb3645310ce
- MD5 88d2df5a0d5fcfaabe5385947720f7b0
- SHA1 0b66be9372d541cd59cd320074cb5c60536e8e87
- SHA512 6c46525bbb216dbef14cf1e79c6c0a939b483eefd24c7d3807846a6ab64078bb615f550c4f458a3ac22eb276d82a7fd31f85b2fd6385e6413ee1bfa68c62e86e
- SSDEEP 393216:FEowXS58owXS1owXS1owXSbowXSQowXSU:Kon58on1on1onbonQonU
- TLSH
  T10D071211B3E694BAD4BB0638D87A62655236BC148752C3BF5690BD6E2D32BC0DD32373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2