303c7192eb303dd49611bac1a9080b709bab6e5190f0ebe9ffd46b1e5a2f1aa1

General

Target
2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos
Size 2.8MB
Sample260809-hnt6lssfph
SHA256 303c7192eb303dd49611bac1a9080b709bab6e5190f0ebe9ffd46b1e5a2f1aa1
MD5 7215bcc0186bf9bc5661f5080d2eb350
SHA1 c35ffe812063379967d0e429ef2f789417f7e066
SHA512 71fdc24a1631f69d5c53fb4164524c82e590a08063990b75465990e17becbeff111cddac78ae42af9a8fec51c82ef4f02fd2acf9c48f45733a25256628409cb6
SSDEEP 49152:OJH35kmJUU15kJBWSU1dN5jiF8IQJVqC:SX6mJUU+ISU1NgE
TLSH
T1AFD5AD13E292B0A1D22E05704672573DEAF57E214B24FBDBAFD0FD612D312D2963B219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos
- Size 2.8MB
- SHA256 303c7192eb303dd49611bac1a9080b709bab6e5190f0ebe9ffd46b1e5a2f1aa1
- MD5 7215bcc0186bf9bc5661f5080d2eb350
- SHA1 c35ffe812063379967d0e429ef2f789417f7e066
- SHA512 71fdc24a1631f69d5c53fb4164524c82e590a08063990b75465990e17becbeff111cddac78ae42af9a8fec51c82ef4f02fd2acf9c48f45733a25256628409cb6
- SSDEEP 49152:OJH35kmJUU15kJBWSU1dN5jiF8IQJVqC:SX6mJUU+ISU1NgE
- TLSH
  T1AFD5AD13E292B0A1D22E05704672573DEAF57E214B24FBDBAFD0FD612D312D2963B219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Installs a root certificate to the trusted certificate store
  A root certificate was added to the trusted certificate store using CertUtil.
  defense_evasion
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2