dbb793fb09adec63b1e36b727ee26b29fe7314b23d4d2b43975ccfde08e40960

General

Target
2026-08-08_030160f9a501435d6ffa0b88495921b1_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_rhadamanthys_smoke-loader_stop_vidar
Size 13.3MB
Sample260808-wyarlssfjb
SHA256 dbb793fb09adec63b1e36b727ee26b29fe7314b23d4d2b43975ccfde08e40960
MD5 030160f9a501435d6ffa0b88495921b1
SHA1 56f6ad0846812c39c32a8b11d375d1aa8e2940b4
SHA512 01c2c3351fa5ef8f590abc145c0ffe9195503e458120dd6562d911ef3afba178b9dc651bcd974b8fa568f5ea532d97eccf2dc1cc3bdcca5a1d7b2d281b1c5f37
SSDEEP 98304:4SjKIjKIjKIjK58ndERQwSXJdWGw6VdIky/Cr4Qkn:9jDjDjDjBndfUkfy/CM5
TLSH
T186E6C706627D84E7F46D2D72849D971809A07E7C1E32C25BFA4276CAE9373C3D5322E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_030160f9a501435d6ffa0b88495921b1_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_rhadamanthys_smoke-loader_stop_vidar
- Size 13.3MB
- SHA256 dbb793fb09adec63b1e36b727ee26b29fe7314b23d4d2b43975ccfde08e40960
- MD5 030160f9a501435d6ffa0b88495921b1
- SHA1 56f6ad0846812c39c32a8b11d375d1aa8e2940b4
- SHA512 01c2c3351fa5ef8f590abc145c0ffe9195503e458120dd6562d911ef3afba178b9dc651bcd974b8fa568f5ea532d97eccf2dc1cc3bdcca5a1d7b2d281b1c5f37
- SSDEEP 98304:4SjKIjKIjKIjK58ndERQwSXJdWGw6VdIky/Cr4Qkn:9jDjDjDjBndfUkfy/CM5
- TLSH
  T186E6C706627D84E7F46D2D72849D971809A07E7C1E32C25BFA4276CAE9373C3D5322E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence spyware stealer trojan upx
- UAC bypass
  defense_evasion trojan
- UPX dump on OEP (original entry point)
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2