193ec6acfe11af260badcd84a0998cee6ab62f3dbce0b6b046f9f73293093990

General

Target
2026-08-05_21b1d1e9848e3b867ee7139b1fb4718f_amadey_cobalt-strike_glassworm_icedid_njrat_quasar-rat_remcos_vidar
Size 53.4MB
Sample260805-newwqszzbw
SHA256 193ec6acfe11af260badcd84a0998cee6ab62f3dbce0b6b046f9f73293093990
MD5 21b1d1e9848e3b867ee7139b1fb4718f
SHA1 1fd1b5afa6a4267b433c7c06787af3cfd7783c06
SHA512 b28cd6147d2d22062e6434f823ba8df165f40d848fd2c17a8b32acc3e6bb58d2aca92f5329f35e73b1374f14f56d06cd29ada9f40c996049bbe0a1db0e70ddd2
SSDEEP 98304:quj9nmiZ76Ya227lNN6Q9jGBSQYnURuFOQhFCfUotYSdYso1GJplIW0qS3fpuGtE:LRnmOHwfoeO02rCSdA1eHIxncUoPR
TLSH
T17AC7544A7B00C98AE5269235A4579FA0B736ED714FB0932732623F5C5FFE34D8DA1098
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-05_21b1d1e9848e3b867ee7139b1fb4718f_amadey_cobalt-strike_glassworm_icedid_njrat_quasar-rat_remcos_vidar
- Size 53.4MB
- SHA256 193ec6acfe11af260badcd84a0998cee6ab62f3dbce0b6b046f9f73293093990
- MD5 21b1d1e9848e3b867ee7139b1fb4718f
- SHA1 1fd1b5afa6a4267b433c7c06787af3cfd7783c06
- SHA512 b28cd6147d2d22062e6434f823ba8df165f40d848fd2c17a8b32acc3e6bb58d2aca92f5329f35e73b1374f14f56d06cd29ada9f40c996049bbe0a1db0e70ddd2
- SSDEEP 98304:quj9nmiZ76Ya227lNN6Q9jGBSQYnURuFOQhFCfUotYSdYso1GJplIW0qS3fpuGtE:LRnmOHwfoeO02rCSdA1eHIxncUoPR
- TLSH
  T17AC7544A7B00C98AE5269235A4579FA0B736ED714FB0932732623F5C5FFE34D8DA1098
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2