2026-08-10_23b2f65a8d5d675d565b0e4c31d9322e_aspxspy_chinachopper_elex_glassworm_hacktools_houdini_piehop_qilin_utkonos_wirefire

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_23b2f65a8d5d675d565b0e4c31d9322e_aspxspy_chinachopper_elex_glassworm_hacktools_houdini_piehop_qilin_utkonos_wirefire
Size 5.0MB
Sample260810-fxefea1hnb
SHA256 55a5e37a0af607483d63425d5301937f2f97ef2d9e8c4b8107cfbf93e1a055e7
MD5 23b2f65a8d5d675d565b0e4c31d9322e
SHA1 6935d3bd3399e1f84535c09e448165dbef6d941f
SHA512 89730dbc707f308f400e009a68e2eecdb1a4d21afca29faa500381e629e978ec0f080010ef1064fb492789cd7281a3faed80e51043f4e87f671989e8086f05b8
SSDEEP 49152:f17YCsUJSBkxyfKu65BIACoYOwvVrtW/0tQrP5IkOKefZW9lS5HehjCi0aZZ:f17YCh4BUtPwa/BW+x31ZZ
TLSH
T1CF366B63EDB74952C552043C02FB0FA07EF5ABD889079A526358BD183D72AEE7C09379
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect executables referencing public and free service interface testing and dev services as means o 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_PublicServiceInterface

Detects JS potentially executing WMI queries 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICOUS_EXE_References_VEEAM

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_23b2f65a8d5d675d565b0e4c31d9322e_aspxspy_chinachopper_elex_glassworm_hacktools_houdini_piehop_qilin_utkonos_wirefire

Office document contains embedded OLE objects 1 IoCs

Detected embedded OLE objects in Office documents.

resource	yara_rule
sample	office_ole_embedded

File Explorer

2026-08-10_23b2f65a8d5d675d565b0e4c31d9322e_aspxspy_chinachopper_elex_glassworm_hacktools_houdini_piehop_qilin_utkonos_wirefire

.exe .js 5.0MB