da15473dfd55518b17cc8701a4e1a11dcf8f49341733dd91a2689f9ab807a09e

General

Target
2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos
Size 2.8MB
Sample260809-g3ya5ssckd
SHA256 da15473dfd55518b17cc8701a4e1a11dcf8f49341733dd91a2689f9ab807a09e
MD5 ffa5637f2d205dddd11896c98e8d4b9d
SHA1 8833b2c776c50aad95843ecd2d54e33156f7423d
SHA512 4f163f29845bc3edc42174388196781e1d39ace8bbe1f54793c0da679e735c677167d3304d37df4dcf8aef02f51c1b988d21550411ec94b5c8babd176b5484a2
SSDEEP 24576:7vxb/+uUAOWLTITR0qnil4LdJYGtJEmZjyGFslcuRyBlOSC4QdcifR+xb81xRfrq:7vOiTCKqfdJfheGFS2U1dN5OWF8IX5SP
TLSH
T132D5AC13E292A0E1D22E15705672577DEAF17E210B21FBD7AFD4FD602D362D1A23B209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos
- Size 2.8MB
- SHA256 da15473dfd55518b17cc8701a4e1a11dcf8f49341733dd91a2689f9ab807a09e
- MD5 ffa5637f2d205dddd11896c98e8d4b9d
- SHA1 8833b2c776c50aad95843ecd2d54e33156f7423d
- SHA512 4f163f29845bc3edc42174388196781e1d39ace8bbe1f54793c0da679e735c677167d3304d37df4dcf8aef02f51c1b988d21550411ec94b5c8babd176b5484a2
- SSDEEP 24576:7vxb/+uUAOWLTITR0qnil4LdJYGtJEmZjyGFslcuRyBlOSC4QdcifR+xb81xRfrq:7vOiTCKqfdJfheGFS2U1dN5OWF8IX5SP
- TLSH
  T132D5AC13E292A0E1D22E15705672577DEAF17E210B21FBD7AFD4FD602D362D1A23B209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery evasion execution persistence ransomware
- Detects executables referencing many IR and analysis tools
- Modifies boot configuration data using bcdedit
  ransomware evasion
- UPX dump on OEP (original entry point)
- Installs a root certificate to the trusted certificate store
  A root certificate was added to the trusted certificate store using CertUtil.
  defense_evasion
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2